16128 matches found
Trust Management Issues Vulnerabilities in Various Amino Communications Products
The Amino Communications AK45x series, among others, is a family of television set-top box devices from Amino UK. Amino Communications has a trust management issue vulnerability in a number of its products, which arises from a root user hard-coded SSH key that can be exploited by an attacker to...
Openpilot Default SSH Key Vulnerability
Openpilot has a default SSH key that can allow attackers remote access if not changed. This script port scans and attempts to login to Openpilot SSH servers with the default key. !/bin/bash openpilot-scan.sh Jeremy Brown jbrown3264/gmail Dec 2020 Checks for openpilot devices using the default SSH...
Secret Backdoor Account Found in Several Zyxel Firewall, VPN Products
Zyxel has released a patch to address a critical vulnerability in its firmware concerning a hardcoded, undocumented secret account that could be abused by an attacker to login with administrative privileges and compromise its networking devices. The flaw, tracked as CVE-2020-29583 CVSS score 7.8,...
Openpilot Default SSH Key Scanner
!/bin/bash openpilot-scan.sh Jeremy Brown jbrown3264/gmail Dec 2020 Checks for openpilot devices using the default SSH key Setup apt-get install -y masscan && setcap capnetraw=ep /usr/bin/masscan wget -q https://raw.githubusercontent.com/commaai/openpilot/master/tools/ssh/idrsa chmod 600 idrsa...
Perth Dropbear Information Disclosure Vulnerability
Perth Dropbear is a lightweight SSH server/client software from the University of Perth, Australia that is primarily used in embedded devices. A security vulnerability exists in Dropbear versions 2011.54 through 2018.76 that stems from an inconsistent failure delay time, which could result in the...
CVE-2020-10210
Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series, Kami7B, an attacker may remotely log in through SSH...
Hardcoded credentials
Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series, Kami7B, an attacker may remotely log in through SSH...
CVE-2020-10210
Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series, Kami7B, an attacker may remotely log in through SSH...
CVE-2020-10210
CVE-2020-10210 affects Amino Communications devices including AK45x, AK5xx, AK65x, Aria6xx, Aria7/AK7Xx, and Kami7B. The root cause is a hard-coded SSH key for the root user, which may allow an attacker to log in remotely via SSH. The public documents state this vulnerability enables remote SSH a...
CVE-2020-25196
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication...
Authentication flaw
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication...
CVE-2020-25196
The CVE-2020-25196 issue affects MOXA NPort IAW5000A-I/O Series where the built-in WEB server in firmware 2.1 or lower allows SSH/Telnet sessions, potentially enabling brute-force authentication to bypass access controls. Affected product: NPort IAW5000A-I/O Series (Firmware Version 2.1 or lower)...
CVE-2020-25196 MOXA NPort IAW5000A-I/O Series
The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication...
Default credentials
Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...
Linux: Read ssh authorized_keys file
The authorizedkeys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. It is a highly important configuration file, as it configures permanent access using SSH keys and needs proper management. Note: This script outputs the conte...
Bento - A Minimal Fedora-Based Container For Penetration Tests And CTF With The Sweet Addition Of GUI Applications
A bento 弁当, bentō is a single-portion take-out or home-packed meal of Japanese origin. Bento Toolkit is a simple and minimal docker container for penetration testers and CTF players. It has the portability of Docker with the addition of X, so you can also run GUI application like burp...
Denial Of Service (DoS)
crypto/ssh in github.com/golang/go is vulnerable to Denial Of Service DoS. The vulnerability is possible because of a nil pointer dereference in the component which allows a remote attacker to cause a denial of service against SSH servers...
Metasploit Wrap-Up
It's the week of December 17th and that can only mean one thing: a week until Christmas! For those of you who don't celebrate Christmas, a very happy Hanukkah/Chanukah, Kwanzaa, Diwali, Chinese New Year, Winter Solstice and Las Posadas to you all! This is our last weekly wrap-up this year, but as...
CVE-2020-29652
A null pointer dereference vulnerability was found in golang. When using the library's ssh server without specifying an option for GSSAPIWithMICConfig, it is possible for an attacker to craft an ssh client connection using the gssapi-with-mic authentication method and cause the server to panic...