PT-2021-23804 · Victure · Victure Wr1200

Published 2021-11-30 · Updated 2021-12-03 · CVE-2021-43284

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Victure WR1200 versions 1.0.0 through 1.0.3

Description An issue was discovered where the root SSH password never gets updated from its default value of admin. This enables an attacker to gain control of the device through SSH, regardless of whether the admin password was changed on the web interface.

Recommendations For Victure WR1200 versions 1.0.0 through 1.0.3, update the root SSH password from the default value of admin to a unique and secure password to prevent unauthorized access.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-43284

Affected Products

Victure Wr1200

References · 5

• 🔥 https://research.nccgroup.com/2021/11/12/technical-advisory-multiple-vulnerabilities-in-victure-wr1200-wifi-router-cve-2021-43282-cve-2021-43283-cve-2021-43284 · Exploit
• 🔥 https://nccgroup.trust/us/our-research/?research=Technical+advisories · Exploit
• https://osv.dev/vulnerability/CVE-2021-43284 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43284 · Security Note
• https://t.me/cibsecurity/33141 · Telegram Post