PT-2019-14225 · Blackbox+1 · Black Box Icompel+1

Frank Barton · Published 2019-08-26 · Updated 2019-09-04 · CVE-2019-15497

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Black Box iCOMPEL versions 9.2.3 through 11.1.4 ONELAN Net-Top-Box versions 9.2.3 through 11.1.4

Description The issue allows remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP due to default credentials.

Recommendations For Black Box iCOMPEL versions 9.2.3 through 11.1.4, change the default credentials to secure ones. For ONELAN Net-Top-Box versions 9.2.3 through 11.1.4, change the default credentials to secure ones.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-15497

Affected Products

Black Box Icompel

Onelan Net-Top-Box

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-15497 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15497 · Vendor Advisory
• https://experiencesofasysadmin.wordpress.com/2019/08/23/cve-2019-15497-default-credentials · Note