PT-2017-12783 · Tecnovision · Tecnovision Dlx Spot Player

Publicado 2017-09-21 · Atualizado 2017-09-29 · CVE-2017-12928

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TecnoVISION DLX Spot Player4 (all known versions)

Description The issue concerns a hard-coded password for the dlxuser account, which is tecn0visi0n. This allows remote attackers to log in via SSH and then escalate privileges to gain root access using the same credentials.

Recommendations For all known versions, consider changing the hard-coded password for the dlxuser account to a unique and secure password to prevent unauthorized access. As a temporary workaround, restrict SSH access to the device until a more permanent solution can be implemented.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-12928

Produtos afetados

Tecnovision Dlx Spot Player

Referências · 2

• http://packetstormsecurity.com/files/144259/DlxSpot-Hardcoded-Password.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-12928 · Nota de Segurança