PT-2017-17811 · Dragonwave · Dragonwave Horizon

Published 2017-04-06 · Updated 2021-09-13 · CVE-2017-7576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DragonWave Horizon versions 1.01.03 through 1.4.7

Description The issue concerns hardcoded login credentials in the DragonWave Horizon wireless radios, including a username of energetic and a password of wireless. These credentials can be used to access the devices via the web interface or by connecting through TELNET.

Recommendations For versions 1.01.03 through 1.4.7, update to version 1.4.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface and TELNET to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-7576

Affected Products

Dragonwave Horizon

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-7576 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7576 · Vendor Advisory
• http://blog.iancaling.com/post/159276197313 · Note
• https://t.me/cvenotify/20744 · Telegram Post