CVE-2017-9385

CRITICAL Year: 2017
CVSS v3 Score
9.8
Critical
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-255
View all →

Vulnerability Description

An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the /etc/cmh/cmh.conf file which can be extracted by an attacker using a directory traversal attack, and then log in to the device with the highest privileges.

Related Vulnerabilities

CVE-2010-5305

CRITICAL
CVSS:9.8(Critical)

The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controllers. The potential exists for an unauthor...

CWE-2552010

CVE-2013-1430

CRITICAL
CVSS:9.8(Critical)

An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the us...

CWE-2552013

CVE-2014-4861

CRITICAL
CVSS:9.8(Critical)

The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a session has ended.

CWE-2552014

CVE-2015-1320

CRITICAL
CVSS:9.8(Critical)

The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.

CWE-2552015

CVE-2015-2874

CRITICAL
CVSS:9.8(Critical)

Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 have a default password of root for the root acco...

CWE-2552015

CVE-2015-3252

CRITICAL
CVSS:9.8(Critical)

Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.

CWE-2552015