PT-2020-12806 · Programi · Programi Bilanc

Georg Ph E Heise · Published 2020-12-18 · Updated 2020-12-23 · CVE-2020-11720

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Programi Bilanc build 007 release 014 31.01.2020 and possibly below

Description An issue was discovered in Programi Bilanc where it sets up administrative access by default with the account admin and password 0000 during installation. After the installation, users/admins are not prompted to change this password.

Recommendations For Programi Bilanc build 007 release 014 31.01.2020 and possibly below, consider changing the default administrative password 0000 to a strong password after installation to prevent unauthorized access. As a temporary workaround, restrict access to the administrative account admin until a more secure configuration can be implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-11720

Affected Products

Programi Bilanc

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-11720 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11720 · Vendor Advisory
• http://seclists.org/fulldisclosure/2020/Dec/34 · Note
• http://packetstormsecurity.com/files/160623/Programi-Bilanc-Build-007-Release-014-31.01.2020-Weak-Default-Password.html · Note
• https://t.me/defcon_news/64565 · Telegram Post
• https://t.me/cibsecurity/21227 · Telegram Post
• https://t.me/cvenotify/7660 · Telegram Post