Default credentials

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...

CVE-2021-41296

CVE-2021-41296 affects ECOA BAS controller family (ECS Router Controller ECS (FLASH), RiskBuster Terminator E6L45, RiskBuster System RB 3.0.0/TRANE 1.0, Ecoa Graphic Control Software, Ecoa SmartHome II, etc.). Root cause: weak/default administrative credentials that can be guessed, allowing remot...

CVE-2021-40866

Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the disabled by default /sqfs/bin/sccd daemon, which fails to check authentication when the authentication TLV is missing from a received NSDP packet. This affects GC108P before 1.0.8....

CVE-2021-40866

Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the disabled by default /sqfs/bin/sccd daemon, which fails to check authentication when the authentication TLV is missing from a received NSDP packet. This affects GC108P before 1.0.8....

PT-2021-22993 · NetGear · Netgear Gc108P +15

Name of the Vulnerable Software and Affected Versions: NETGEAR GC108P versions prior to 1.0.8.2 NETGEAR GC108PP versions prior to 1.0.8.2 NETGEAR GS108Tv3 versions prior to 7.0.7.2 NETGEAR GS110TPP versions prior to 7.0.7.2 NETGEAR GS110TPv3 versions prior to 7.0.7.2 NETGEAR GS110TUP versions pri...

COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure Vulnerability

Exploit Title: COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure Exploit Author: LiquidWorm Vendor Homepage: https://www.commax.com COMMAX CVD-Axx DVR 5.1.4 Weak Default Credentials Stream Disclosure Vendor: COMMAX Co., Ltd. Prodcut web page: https://www.commax.com Affected...

COMMAX CVD-Axx DVR 5.1.4 Weak Default Credentials Stream Disclosure

Summary COMMAX offers a wide range of proven AHD CCTV systems to meet customer needs and convenience in single or multi-family homes. Description The web control panel uses weak set of default administrative credentials that can be easily guessed in remote password attacks and disclose RTSP strea...

VulnCheck KEV: CVE-2020-25078

D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users should discontinue product utilization...

SOYAL Biometric Access Control System 5.0 Weak Default Credentials

Summary Soyal Access systems are built into Raytel Door Entry Systems and are providing access and lift control to many buildings from public and private apartment blocks to prestigious public buildings. Description The web control panel uses weak set of default administrative credentials no...

The vulnerability of the microprogrammed network router Advantech BB-ERT351, related to the use of a unreliable cryptographic algorithm, allows a hacker to retrieve the administrator password from the hash.

The vulnerability of the microprogrammed network router Advantech BB-ERT351 is related to the use of a unreliable cryptographic algorithm for hashing passwords. Exploiting this vulnerability could allow an attacker, operating remotely, to retrieve the administrator’s password from the hash...

Constructor.Win32.SpyNet.a Remote Password Leak

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/1717731c32830a31e84b74641a4fdec7.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Constructor.Win32.SpyNet.a Vulnerability: Remote Password Leak Description: Spy-Net RAT v0.7,...

Bosch FSM-2500 和 Bosch FSM-5000 访问控制错误漏洞

Bosch FSM-2500 and Bosch FSM-5000 are both panel-ready fire control systems from Bosch of Germany. Bosch FSM-2500 and Bosch FSM-5000 are vulnerable to a password disclosure vulnerability that could be exploited by a remote attacker to submit a special request that could gain access to sensitive...

CMCC R3S-3 at CMCC IoT Ltd. is vulnerable to logic flaws

The CMCC R3S-3 is a router. A logic flaw vulnerability exists in the CMCC R3S-3 of CMCC Internet of Things Ltd. An attacker can exploit the vulnerability to remotely and arbitrarily change the password of the management side...

CVE-2020-35575

A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9201211 beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N,...

CVE-2020-25015

A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally used at homes and offices was found to be vulnerable to Broken Access Control and CSRF which could be combined to remotely change the WIFI access point’s password...

Improper access control

A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally used at homes and offices was found to be vulnerable to Broken Access Control and CSRF which could be combined to remotely change the WIFI access point’s password...

The vulnerability of the distributed application server SPPA-T3000 lies in its ability to access the administration services for the application server and obtain user passwords as hash codes. This allows attackers to modify the passwords of application server users.

The vulnerability of the distributed application server SPPA-T3000 relates to the ability to access the administration services for the application server and obtain user passwords as hash codes. Exploiting this vulnerability could allow a malicious actor to remotely change the passwords of the...

Remote Password Change Vulnerability in Haiwell's Cloud Configuration Software Cloud SCADA

Haiwell Haiwell Cloud SCADA is an industrial automation monitoring and management platform software developed by Xiamen Haiwell Technology Co. A remote password change vulnerability exists in Haiwell Cloud SCADA, which can be exploited by an attacker to change the password of the running system...

PT-2020-12955 · Iqrouter · Iqrouter

Name of the Vulnerable Software and Affected Versions: IQrouter versions 3.3.1 and earlier Description: The issue allows remote attackers to change the root password arbitrarily using the Lua function diag set password in the web-panel. This can occur on a brand-new network that has not been...

CVE-2020-5725

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the login action with a crafted username and, through the use of timing attacks, can discover user passwords...