Crlf injection

CRLF injection vulnerability in the web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via th...

CVE-2014-9563

CRLF injection vulnerability in the web-based management WBM interface in Unify former Siemens OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 allows remote authenticated users to modify the root password and consequently access the debug port using the serial interface via th...

CVE-2018-9149

The Zyxel Multy X AC3000 Tri-Band WiFi System device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a USB-to-UART cable to connect the device, he can use the 1234 password for the root account to login to the system. Furthermore, an attacker...

The vulnerability of microprogramming software in media devices from Valve’s Steam Link, related to the reduction of passwords to 8 characters, allows attackers to gain access to the device with root privileges.

The vulnerability of microprogramming software in media devices from Valve’s Steam Link stems from the fact that the password for the root account is shortened to 8 characters due to the use of the cryptographic protocol DES. Exploiting this vulnerability allows a malicious actor to gain access t...

360 Wireless IP Camera is vulnerable (CNVD-2018-06852)

360 Wireless IP Camera is a webcam product from China's Qihoo 360 Qihu 360. A security vulnerability exists in the 360 Wireless IP Camera, which originates from the root account using a known SHA-512 password hash. The vulnerability can be exploited by a remote attacker to gain administrative...

IoT hack: how to break a smart home… again

There can never be too many IoT gadgets – that's what people usually think when buying yet another connected device with advanced functionality. From our perspective, we also think there can't be too many IoT investigations. So, we have continued our experiments into checking and uncovering how...

foreman: inside discovery-debug, the root password is displayed in plaintext

A flaw was found in discovery-debug in foreman. An attacker, with permissions to view the debug results, would be able to view the root password associated with that system, potentially allowing them to access it...

Extreme Networks ExtremeWireless WiNG Elevation of Privilege Vulnerability

Extreme Networks ExtremeWireless WiNG is a wireless access solution from Extreme Networks. A security vulnerability exists in the generation of root shell access passwords in Extreme Networks ExtremeWireless WiNG version 5.x prior to 5.8.6.9 and version 5.9.x prior to 5.9.1.3. An attacker can...

The vulnerability of the Zivif PR115-204-P-RS webcam’s microprogramming software relates to the use of pre-installed credentials, allowing a intruder to gain access to the device with root privileges.

The vulnerability of the Zivif PR115-204-P-RS webcam’s microprogramming software is related to the use of pre-set credentials the password “cat1029” for the “root” user. Exploiting this vulnerability allows a malicious actor to gain access to the device with root privileges through a Telnet...

ovirt-hosted-engine-setup information disclosure vulnerability

ovirt-hosted-engine-setup is a web hosting engine installation tool. An information disclosure vulnerability exists in versions of ovirt-hosted-engine-setup prior to 2.2.7. An attacker can exploit this vulnerability to obtain the root user password in a log file...

Race condition

Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed...

CVE-2014-4995

Vulnerability CVE-2014-4995 affects the VladTheEnterprising Ruby gem (version ~0.2); a race condition in lib/vlad/dba/mysql.rb allows local users to obtain the MySQL root password from a temporary file before it is removed. Related advisories describe insecure temporary file handling and potentia...

CVE-2017-17878

An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...

CVE-2017-17878

An issue was discovered in Valve Steam Link build 643. Root passwords longer than 8 characters are truncated because of the default use of DES aka the CONFIGFEATUREDEFAULTPASSWDALGO="des" setting...

CVE-2017-17878

CVE-2017-17878 affects Valve Steam Link build 643. The root password handling truncates passwords longer than 8 characters due to the default DES algorithm (CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="des"). The issue is documented across multiple sources (NVD entry, Red Hat CVEs, and related disclosures...

CVE-2017-17107

Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password unchangeable and it can be used to access the device via a TELNET session...

The vulnerability of D-Link DWR-932B router’s microprogramming software lies in the use of pre-installed accounts, allowing a hacker to gain access to the device with root privileges.

The vulnerability of the D-Link DWR-932B router’s microprogramming software lies in the use of pre-set accounts “admin” and “root”, with passwords “admin” and “1234” respectively. Exploiting this vulnerability allows a malicious actor to gain access to the device with root privileges via Telnet o...

Coredy CX-E120 Repeater Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in Coredy CX-E120 Repeater. The Coredy CX-E120 WiFi Range Extender is “a network device with multifunction, which can be using for increasing the distance of a WiFi network by boosting the existing WiFi signal an...

VulnCheck KEV: CVE-2016-10401

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP's deployment of these devices...

The vulnerability of microprogrammed switching equipment such as GigaOrion, GigaLynx, GigaPlus, and GigaPro, as well as external switching modules like Apex, ApexLynx, ApexOrion, StrataLink, and StrataPro, stems from the use of pre-installed user accounts. This allows attackers to gain access to the embedded operating system with administrator privileges.

The vulnerability of microprogrammed switching equipment such as GigaOrion, GigaLynx, GigaPlus, and GigaPro, as well as external switching modules like Apex, ApexLynx, ApexOrion, StrataLink, and StrataPro, stems from the use of a pre-installed root account password, which is stored publicly in th...