PT-2018-10276 · Unknown · Emc Integrated Data Protection Appliance

Publicado 2018-11-02 · Atualizado 2019-01-30 · CVE-2018-11062

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Integrated Data Protection Appliance versions 2.0 through 2.2

Description The issue concerns undocumented accounts named support and admin that are protected with default passwords, allowing a malicious user with knowledge of these passwords to potentially log in to the system. These accounts have limited privileges, granting access to certain system files for read and write operations.

Recommendations For versions 2.0 through 2.2, change the default passwords of the support and admin accounts to secure passwords to prevent unauthorized access. As a temporary workaround, consider disabling the support and admin accounts until secure passwords are set. Restrict access to system files that can be accessed by these accounts to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-11062

Produtos afetados

Emc Integrated Data Protection Appliance

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-11062 · Nota de Segurança
• http://securityfocus.com/bid/105764 · Nota
• https://seclists.org/fulldisclosure/2018/Oct/53 · Nota
• https://osv.dev/vulnerability/CVE-2018-11062 · Aviso do Fabricante