Emerson OpenBSI

1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Emerson Equipment: OpenBSI Vulnerabilities: Use of Broken or Risky Cryptographic Algorithm, Use of Hard-coded Cryptographic Key CISA is aware of a public report, “OT:ICEFALL,” that details...

CVE-2022-22144

A hard-coded password vulnerability exists in the libcommonprod.so prodchangerootpasswd functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this...

CVE-2022-22144

A hard-coded password vulnerability exists in the libcommonprod.so prodchangerootpasswd functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this...

Hardcoded credentials

A hard-coded password vulnerability exists in the libcommonprod.so prodchangerootpasswd functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this...

CVE-2022-22144

A hard-coded password vulnerability exists in the libcommonprod.so prodchangerootpasswd functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this...

CVE-2022-22144

A hard-coded password vulnerability exists in the libcommonprod.so prodchangerootpasswd functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this...

PT-2022-15272 · Tcl · Tcl Linkhub Mesh Wi-Fi

Name of the Vulnerable Software and Affected Versions: TCL LinkHub Mesh Wi-Fi MS1G 00 01.00 14 Description: A hard-coded password vulnerability exists in the libcommonprod.so prod change root passwd functionality. This functionality is called during system startup, resulting in a known root...

CVE-2022-34993

Totolink A3600RFirmware V4.1.2cu.5182B20201102 contains a hard code password for root in /etc/shadow.sample...

CVE-2022-34993

Totolink A3600R firmware V4.1.2cu.5182_B20201102 contains a hard-coded root password in /etc/shadow.sample , enabling a likely unauthenticated network attacker to obtain root access and compromise the device. Affected component: root password in /etc/shadow.sample. Root cause: hard-coded credenti...

CVE-2022-32965

OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service...

CVE-2022-32965

OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service...

CVE-2022-35216 ITPison OMICARD EDM - Use of Hard-coded Credentials

OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authentication and access arbitrary system files...

CVE-2022-32965

CVE-2022-32965 affects OMICARD EDM due to a hard-coded machine key in the server, enabling an unauthenticated remote attacker to send a serialized payload to execute arbitrary code, manipulate system data, and disrupt service. The PT-2022-21613 entry provides concrete details (affected software, ...

CVE-2022-32965 ITPison OMICARD EDM - Use of Hard-coded Credentials

OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service...

CVE-2022-32965

OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service...

TCL LinkHub Mesh Wi-Fi prod_change_root_passwd function hard-coded vulnerability

TCL LinkHub Mesh Wi-Fi is a router from TCL Corporation. The TCL LinkHub Mesh Wi-Fi prodchangerootpasswd feature is hard-coded vulnerable. An attacker can exploit this vulnerability to obtain the root password...

Emerson DeltaV Distributed Control System Use of Hard-Coded Credentials (CVE-2022-29963)

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a root shell via hardcoded credentials. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350. - The...

Emerson DeltaV Distributed Control System Use of Hard-Coded Credentials (CVE-2022-29964)

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350. - The Emerson DeltaV Distributed Control System DCS...

Emerson DeltaV Distributed Control System Use of Hard-Coded Credentials (CVE-2022-29962)

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials but may often be disabled in production. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350. - The Emerson...

CVE-2022-35866

This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MySQL server. The server uses a hard-cod...