PT-2021-19428 · Akkadian · Akkadian Provisioning Manager Engine+2

Cale Black + 4 · Published 2021-06-15 · Updated 2021-08-09 · CVE-2021-31579

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Akkadian Provisioning Manager Engine (PME) versions prior to 5.0.2 Akkadian OVA appliance versions prior to 3.0 Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0

Description The issue concerns a hard-coded credential, with the username akkadianuser and password haakkadianpassword. This poses a significant security risk as it could allow unauthorized access.

Recommendations For Akkadian Provisioning Manager Engine (PME) versions prior to 5.0.2, update to version 5.0.2 or later. For Akkadian OVA appliance versions prior to 3.0, update to version 3.0 or later. For Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0, update to version 3.3.0.314-4a349e0 or later.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-31579

Affected Products

Akkadian Appliance Manager

Akkadian Ova Appliance

Akkadian Provisioning Manager Engine

References · 4

• 🔥 https://rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-31579 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31579 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/3617 · Telegram Post