PT-2016-3203 · Openelec+1 · Openelec+1

Cyclotron3Ko · Published 2016-02-02 · Updated 2016-02-25 · CVE-2016-2230

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenELEC (affected versions not specified) RasPlex (affected versions not specified)

Description The issue is related to a hardcoded password for the root account in OpenELEC and RasPlex devices, making it easier for remote attackers to obtain access via an SSH session. This allows a remote attacker to exploit the vulnerability and gain access to the device using the SSH protocol.

Recommendations For OpenELEC, consider changing the hardcoded root password to a unique and secure password as a temporary workaround. For RasPlex, restrict access to the root account until a more permanent solution is available. As a general mitigation measure, restrict SSH access to only necessary users and consider disabling the root account for SSH access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

CWE-259

Related Identifiers

BDU:2017-02483

CVE-2016-2230

Affected Products

Openelec

Rasplex

References · 4

• https://bdu.fstec.ru/vul/2017-02483 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-2230 · Security Note
• https://github.com/RasPlex/RasPlex/issues/453 · Note
• http://kb.cert.org/vuls/id/544527 · Note