CVE-2021-28909

BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'admin'. This is usable and part of an attack chain to gain SSH root access.

BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'admin'. This is usable and part of an attack chain to gain SSH root access.

BAB TECHNOLOGIE GmbH eibPort versiones V3 anteriores a 3.9.1, permiten a atacantes no autenticados acceder sin control al servicio de login en /webif/SecurityModule en un ataque de fuerza bruta. La contraseña podría ser débil y el nombre de usuario predeterminado es conocido como "admin". Esto es usable y forma parte de una cadena de ataque para conseguir acceso root SSH