PT-2020-16280 · Planet Technology · Nvr-1615+1

Published 2020-11-18 · Updated 2024-08-04 · CVE-2020-26097

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PLANET Technology Corp NVR-915 versions before 2020-10-28 PLANET Technology Corp NVR-1615 versions before 2020-10-28

Description The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 embeds default credentials for root access via telnet. By exposing telnet on the Internet, remote root access on the device is possible. This issue only affects products that are no longer supported by the maintainer.

Recommendations For PLANET Technology Corp NVR-915 versions before 2020-10-28, consider disabling telnet access to prevent remote root access. For PLANET Technology Corp NVR-1615 versions before 2020-10-28, consider disabling telnet access to prevent remote root access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-26097

Affected Products

Nvr-1615

Nvr-915

References · 4

• 🔥 https://sec-research.com/1604584604-hard-coded-credentials-in-netzwerk-videorekorder-planet-nvr-915.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26097 · Security Note
• https://t.me/cibsecurity/16521 · Telegram Post
• https://t.me/cvenotify/89030 · Telegram Post