PT-2012-5485 · Linux+2 · Linux+2

Reid Wightman · Publicado 2012-08-21 · Atualizado 2017-08-29 · CVE-2012-4577

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Korenix Jetport 5600 series (affected versions not specified) ORing Industrial DIN-Rail serial-device servers (affected versions not specified)

Description The issue concerns a hardcoded password in the Linux firmware image. Specifically, the root account has a hardcoded password of password, allowing remote attackers to gain administrative access via an SSH session.

Recommendations For Korenix Jetport 5600 series, change the hardcoded password for the root account as soon as possible. For ORing Industrial DIN-Rail serial-device servers, update the firmware to remove or change the hardcoded password for the root account. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2012-4577

Produtos afetados

Korenix Jetport 5600 Series

Linux

Oring Industrial Din-Rail Serial-Device Servers

Referências · 6

• http://ics-cert.us-cert.gov/advisories/ICSA-12-297-02 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77992 · Nota
• http://digitalbond.com/2012/06/13/korenix-and-oring-insecurity · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4577 · Nota de Segurança
• http://securityfocus.com/bid/55196 · Nota
• http://ics-cert.us-cert.gov/advisories/ICSA-12-263-02 · Nota