10

CVE-2016-1560

Exploit
ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exagrid ≫ Ex3000 Firmware Version 4.8
   Exagrid ≫ Ex3000 Version -
Exagrid ≫ Ex5000 Firmware Version 4.8
   Exagrid ≫ Ex5000 Version -
Exagrid ≫ Ex7000 Firmware Version 4.8
   Exagrid ≫ Ex7000 Version -
Exagrid ≫ Ex10000e Firmware Version 4.8
   Exagrid ≫ Ex10000e Version -
Exagrid ≫ Ex13000e Firmware Version 4.8
   Exagrid ≫ Ex13000e Version -
Exagrid ≫ Ex21000e Firmware Version 4.8
   Exagrid ≫ Ex21000e Version -
Exagrid ≫ Ex32000e Firmware Version 4.8
   Exagrid ≫ Ex32000e Version -
Exagrid ≫ Ex40000e Firmware Version 4.8
   Exagrid ≫ Ex40000e Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 72.29% 0.994
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

http://packetstormsecurity.com/files/136634/ExaGrid-Known-SSH-Key-Default-Password.html
Third Party Advisory
Exploit
VDB Entry
http://www.rapid7.com/db/modules/exploit/linux/ssh/exagrid_known_privkey
Third Party Advisory
https://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials
Third Party Advisory
Exploit
Mitigation