PT-2019-9670 · Tightrope Media Systems · Tightrope Media Carousel Seneca Hdn

Drew Green · Publicado 2019-10-29 · Atualizado 2019-11-05 · CVE-2018-18929

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tightrope Media Carousel Seneca HDn version 7.0.4.104

Description The issue concerns a default local administrator username and password that can be discovered by a limited user account. This sensitive information is stored in an "unattend.xml" file on the C: drive, which is a leftover from the Sysprep process. An attacker who obtains this username and password can use it to gain administrator-level access to the system.

Recommendations For version 7.0.4.104, change the default local administrator username and password to unique and secure credentials to prevent unauthorized access. Additionally, consider restricting access to the "unattend.xml" file to minimize the risk of exploitation.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-18929

Produtos afetados

Tightrope Media Carousel Seneca Hdn

Referências · 3

• 🔥 https://drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel · Exploit
• https://osv.dev/vulnerability/CVE-2018-18929 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18929 · Nota de Segurança