PT-2015-3335 · Gynoii · Gynoii

Publicado 2015-07-04 · Atualizado 2017-04-13 · CVE-2015-2881

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gynoii (affected versions not specified)

Description The issue is related to the presence of predefined 'guest' and 'admin' accounts with passwords 'guest' and '12345' respectively. This could allow a remote attacker to gain access to the device using the web interface.

Recommendations For all affected versions, consider changing the default passwords of the 'guest' and 'admin' accounts to strong, unique passwords to prevent unauthorized access. As a temporary workaround, restrict access to the web interface until the issue is resolved. Avoid using the default passwords for the 'guest' and 'admin' accounts in the device configuration.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

BDU:2017-02469

CVE-2015-2881

Produtos afetados

Gynoii

Referências · 3

• 🔥 https://community.rapid7.com/community/infosec/blog/2015/09/02/iotsec-disclosure-10-new-vulns-for-several-video-baby-monitors · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2881 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-02469 · Nota de Segurança