Swann SRNVW-470 allows unauthorized access to video stream and contains a hard-coded password

Overview Swann network video recorder NVR devices contain a hard-coded password and do not require authentication to view the video feed when accessing from specific URLs. Description CWE-259: Use of Hard-coded Password - CVE-2015-8286 According to the researcher, the Swann SRNVW-470LCD and Swann...

Zhuhai Raysharp firmware for DVRs from multiple vendors contains hard-coded credentials

Overview Digital Video Recorders DVRs, security cameras, and possibly other devices from multiple vendors use a firmware derived from Zhuhai RaySharp that contains a hard-coded root password. Description CWE-259: Use of Hard-coded Password- CVE-2015-8286 According to the reporter, DVR devices bas...

The vulnerability of the microprogramming software in the remote control system for solar panels, SMA Solar Sunny WebBox, allows a intruder to gain access to the device.

The vulnerability of the microprogramming software in the SMA Solar Sunny WebBox remote control system includes hard-coded default passwords. Exploiting this vulnerability could allow a malicious actor to gain access to the device remotely...

MGASA-2016-0053 Updated socat packages fix security vulnerability

In socat before 2.0.0-b9, in the OpenSSL address implementation, the hard coded 1024 bit DH p parameter was not prime. It may be possible for an eavesdropper to recover the shared secret from a key exchange CVE-2016-2217. In socat before 2.0.0-b9, a stack overflow vulnerability was found that can...

OpenELEC and RasPlex have a hard-coded SSH root password

Overview OpenELEC and derivatives utilize a hard-coded default root password, and enable SSH root access by default. Description CWE-259: Use of Hard-coded Password OpenELEC has a hard-coded root password. The root partition is by default read-only, preventing a user from changing the password on...

Westermo Industrial switches hard-coded certificate vulnerability

Westermo Industrial Switches is an industrial Ethernet switch product from Westermo, Sweden. A security vulnerability exists in Westermo Industrial switches that allows remote attackers to conduct man-in-the-middle attacks and gain unauthorized access to the device...

Unspecified vulnerability in Harman AMX (CNVD-2016-00786)

Harman AMX is a series of conversion controller products from Harman USA. A security vulnerability exists in the 'setUpSubtleUserAccount' function in the /bin/bw URI in versions of Harman AMX prior to 2015-10-12, which stems from the use of hard-coded passwords for BlackWidow accounts. A remote...

Cisco Modular Encoding Platform D9036 Software Insecure Default Password Vulnerability

Cisco Modular Encoding Platform D9036 Software is the United States Cisco Cisco based on the D9036 modular encoding platform for improving video quality application software. A security vulnerability exists in versions of Cisco Modular Encoding Platform D9036 Software prior to 02.04.70, which ste...

Unspecified Vulnerability in Harman AMX

Harman AMX is a series of conversion controller products from Harman USA. A security vulnerability exists in the 'setUpSubtleUserAccount' function in the /bin/bw URI in versions of Harman AMX prior to 2016-01-20, which stems from the use of a hard-coded password for the 1MB@tMaN account. A remote...

Lenovo eggplant fast pass（Lenovo ShareIT is exposed to many vulnerabilities-vulnerability warning-the black bar safety net

Lenovo ShareIT（eggplant fast pass service is proof there is a hard-coded password, information leakage, sensitive information is not encrypted, unauthorized vulnerability, bug submitter from Core Security Consulting team the security researcher Ivan Huertas, this report from the same team of...

Oh Snap! Lenovo protects your Security with '12345678' as Hard-Coded Password in SHAREit

What do you expect a tech giant to protect your backdoor security with? Holy Cow! It's "12345678" as a Hard-Coded Password. Yes, Lenovo was using one of the most obvious, awful passwords of all time as a hard-coded password in its file sharing software SHAREit that could be exploited by anyone wh...

Lenovo SHAREit App Hard-Coded Password

Lenovo today has patched a number of vulnerabilities that jeopardize private data, which are largely enabled by a simple hard-coded password in a freely available file-sharing application. The flaws were found in in the Lenovo ShareIT application for Android and Windows by researchers at Core...

Lenovo ShareIT Information Disclosure / Hardcoded Password

Advisory Information Title: Lenovo ShareIT Multiple Vulnerabilities Advisory ID: CORE-2016-0002 Advisory URL: http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities Date published: 2016-01-25 Date of last update: 2016-01-22 Vendors contacted: Lenovo Release mode:...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2016-00441)

Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform. Fortinet FortiOS has a FortimanagerAccess account that uses hard-coded passwords, allowing a remote attacker to gain administrator access via an SSH session with the help of this account...

Harman AMX multimedia devices contain hard-coded credentials

Overview Multiple models of Harman AMX multimedia devices contain a hard-coded debug account. Description CWE-798: Use of Hard-coded Credentials - CVE-2015-8362According to the researchers' blog post, several models of Harman AMX multimedia devices contain a hard-coded "backdoor" account with...

Advantech EKI Vulnerable to Bypass, Possible Backdoor

Researchers have uncovered yet another issue–and potential backdoor–in Advantech’s beleaguered EKI-1322 serial device server. The Dropbear SSH daemon associated with the server, because of heavy modifications, fails to enforce authentication. This makes it so any user who wants to bypass...

Someone Just Leaked Hard-Coded Password Backdoor for Fortinet Firewalls

Are millions of enterprise users, who rely on the next-generation firewalls for protection, actually protected from hackers? Probably Not. Just less than a month after an unauthorized backdoor found in Juniper Networks firewalls, an anonymous security researcher has discovered highly suspicious...

Pro-face GP-Pro EX HMI Vulnerabilities

OVERVIEW ZDI Zero Day Initiative has identified one information disclosure and two buffer overflow vulnerabilities, and independent researcher Jeremy Brown has identified hard-coded credentials in Pro-face’s GP-Pro EX HMI software. Pro-face has produced a module to mitigate these vulnerabilities...

SAP Hybris E-commerce Suite VirtualJDBC - Default Credentials

Application: SAP Hybris E-commerce Suite Versions Affected: SAP Hybris E-commerce Suite 5.1.0.3 Vendor URL: SAP Bugs: Default credentials Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 10.05.2016 Author: Alexey Tyurin ERPScan VULNERABILITY INFORMATION Class: CWE-259 Use...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-085-01 Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities, that was published March 26, 2015, to the NCCIC/ICS-CERT web site. Gleb Gritsai, Ilya Karpov, and Kirill Nesterov o...