The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device…
mitre·CWE-798·Published 2017-03-06
The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account. This account is not documented, nor is the DEBUG feature or the use of telnetd on port tcp/5885.
The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account. This account is not documented, nor is the DEBUG feature or the use of telnetd on port tcp/5885.
El dispositivo WePresent WiPG-1500 con firmware 1.0.3.7 tiene una cuenta de fabricante que tiene un nombre de usuario / contraseña codificados. Una vez que el dispositivo está configurado en el modo DEBUG, un atacante puede conectarse al dispositivo usando el protocolo telnet e iniciar sesión en el dispositivo con la cuenta de fabricante codificada "abarco". Esta cuenta no está documentada, ni tampoco lo está la característica DEBUG o el uso de telnetd en puerto tcp/5885.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 2.0 | Primary | NVD | 9.3 | 8.6 | 10.0 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| 3.0 | Primary | NVD | 8.1 | 2.2 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |