CVE-2016-1560

ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cret@cert.org

Published

2017-04-21

Last modified

2024-08-05

Weaknesses

CWE-798

Affected products

• Ex10000e Firmware (Exagrid)
• Ex13000e Firmware (Exagrid)
• Ex21000e Firmware (Exagrid)
• Ex3000 Firmware (Exagrid)
• Ex32000e Firmware (Exagrid)
• Ex40000e Firmware (Exagrid)
• Ex5000 Firmware (Exagrid)
• Ex7000 Firmware (Exagrid)

References

• http://packetstormsecurity.com/files/136634/ExaGrid-Known-SSH-Key-Default-Password.html
• http://www.rapid7.com/db/modules/exploit/linux/ssh/exagrid_known_privkey
• https://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-crede…