Common Weakness Enumeration
CWE-1391
Allowed-with-ReviewUse of Weak Credentials
Abstraction: Class · Status: Incomplete
The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
103 vulnerabilities reference this CWE, most recent first.
CVE-2023-31240 (GCVE-0-2023-31240)
Vulnerability from cvelistv5 – Published: 2023-05-22 19:58 – Updated: 2025-01-16 21:33
VLAI
EPSS
VEX
Summary
Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-16 20:55 UTC
CWE
- CWE-1391 - se of Weak Credentials
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Snap One | OvrC Cloud |
Affected:
0 , < 7.3
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:53:30.145Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-31240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-16T20:55:30.406248Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-16T21:33:20.754Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OvrC Cloud",
"vendor": "Snap One",
"versions": [
{
"lessThan": "7.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Uri Katz of Claroty reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSnap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1391",
"description": "CWE-1391Use of Weak Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T17:34:00.669Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01"
},
{
"url": "https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSnap One has released the following updates/fixes for the affected products:\u003c/p\u003e\u003cul\u003e\u003cli\u003eOvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.\u003c/li\u003e\u003cli\u003eOvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.\u003c/li\u003e\u003cli\u003eDisable UPnP.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor more information, see Snap One\u2019s \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf\"\u003eRelease Notes\u003c/a\u003e.\u003c/p\u003e"
}
],
"value": "Snap One has released the following updates/fixes for the affected products:\n\n * OvrC Pro v7.2 has been automatically pushed out to devices to update via OvrC cloud.\n * OvrC Pro v7.3 has been automatically pushed out to devices to update via OvrC cloud.\n * Disable UPnP.\n\n\nFor more information, see Snap One\u2019s Release Notes https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-p.pdf ."
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2023-31240",
"datePublished": "2023-05-22T19:58:48.755Z",
"dateReserved": "2023-04-26T19:18:23.304Z",
"dateUpdated": "2025-01-16T21:33:20.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3470 (GCVE-0-2023-3470)
Vulnerability from cvelistv5 – Published: 2023-08-02 15:54 – Updated: 2024-10-22 12:34
VLAI
EPSS
VEX
Title
BIG-IP FIPS HSM password vulnerability CVE-2023-3470
Summary
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest.
The following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F.
The BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity
6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 20:42 UTC
CWE
- CWE-1391 - Use of Weak Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://my.f5.com/manage/s/article/K000135449 | vendor-advisory |
Impacted products
Date Public
2023-10-18 14:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:55:03.584Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://my.f5.com/manage/s/article/K000135449"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3470",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T20:42:33.121532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T12:34:45.503Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"All Modules"
],
"product": "BIG-IP",
"vendor": "F5",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "16.0.0",
"versionType": "semver"
},
{
"lessThan": "15.1.1",
"status": "affected",
"version": "15.1.0",
"versionType": "semver"
},
{
"lessThan": "14.1.4",
"status": "affected",
"version": "14.1.0",
"versionType": "semver"
},
{
"lessThan": "13.1.4",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "F5"
}
],
"datePublic": "2023-10-18T14:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eSpecific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. \u0026nbsp;The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. \u0026nbsp;On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest.\u003c/p\u003e\u003cp\u003eThe following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F.\u003c/p\u003e\u003cp\u003eThe BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations.\u003c/p\u003e\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\u003cbr\u003e\n\n"
}
],
"value": "\nSpecific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. \u00a0The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. \u00a0On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest.\n\nThe following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F.\n\nThe BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations.\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1391",
"description": "CWE-1391 Use of Weak Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-02T15:54:14.218Z",
"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
"shortName": "f5"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://my.f5.com/manage/s/article/K000135449"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "BIG-IP FIPS HSM password vulnerability CVE-2023-3470",
"x_generator": {
"engine": "F5 SIRTBot v1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
"assignerShortName": "f5",
"cveId": "CVE-2023-3470",
"datePublished": "2023-08-02T15:54:14.218Z",
"dateReserved": "2023-06-30T00:29:46.174Z",
"dateUpdated": "2024-10-22T12:34:45.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-0635 (GCVE-0-2023-0635)
Vulnerability from cvelistv5 – Published: 2023-06-05 03:42 – Updated: 2025-01-08 16:42
VLAI
EPSS
VEX
Title
Privilege escalation to root
Summary
Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Privilege Escalation.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.01; NEXUS Series: from 3.0;0 before 3.07.01; MATRIX Series: from 3.0;0 before 3.07.01.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-08 16:42 UTC
CWE
- CWE-1391 - Use of Weak Credentials
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| ABB Ltd. | ASPECT®-Enterprise |
Affected:
3.0;0 , < 3.07.01
(update)
|
|
| ABB Ltd. | NEXUS Series |
Affected:
3.0;0 , < 3.07.01
(update)
|
|
| ABB Ltd. | MATRIX Series |
Affected:
3.0;0 , < 3.07.01
(update)
|
Date Public
2023-06-01 06:30
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:17:50.128Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-0635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-08T16:42:41.700285Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-08T16:42:53.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"2CQG103201S3021",
"2CQG103202S3021",
"2CQG103203S3021",
"2CQG103204S3021"
],
"platforms": [
"ASPECT\u00ae-Enterprise",
"Linux"
],
"product": "ASPECT\u00ae-Enterprise",
"vendor": "ABB Ltd.",
"versions": [
{
"lessThan": "3.07.01",
"status": "affected",
"version": "3.0;0",
"versionType": "update"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"2CQG100102R2021",
"2CQG100104R2021",
"2CQG100105R2021",
"2CQG100106R2021",
"2CQG100110R2021",
"2CQG100112R2021",
"2CQG100103R2021",
"2CQG100107R2021",
"2CQG100108R2021",
"2CQG100109R2021",
"2CQG100111R2021",
"2CQG100113R2021"
],
"platforms": [
"NEXUS Series",
"Linux"
],
"product": "NEXUS Series",
"vendor": "ABB Ltd.",
"versions": [
{
"lessThan": "3.07.01",
"status": "affected",
"version": "3.0;0",
"versionType": "update"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"2CQG100102R1021",
"2CQG100103R1021",
"2CQG100104R1021",
"2CQG100105R1021",
"2CQG100106R1021"
],
"platforms": [
"MATRIX Series",
"Linux"
],
"product": "MATRIX Series",
"vendor": "ABB Ltd.",
"versions": [
{
"lessThan": "3.07.01",
"status": "affected",
"version": "3.0;0",
"versionType": "update"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "ABB would like to thank Prism Infosec for identifying this vulnerability in its products and for dealing with it in a professional manner."
}
],
"datePublic": "2023-06-01T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Privilege Management vulnerability in ABB Ltd. ASPECT\u00ae-Enterprise on ASPECT\u00ae-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Privilege Escalation.\u003cp\u003eThis issue affects ASPECT\u00ae-Enterprise: from 3.0;0 before 3.07.01; NEXUS Series: from 3.0;0 before 3.07.01; MATRIX Series: from 3.0;0 before 3.07.01.\u003c/p\u003e"
}
],
"value": "Improper Privilege Management vulnerability in ABB Ltd. ASPECT\u00ae-Enterprise on ASPECT\u00ae-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Privilege Escalation.This issue affects ASPECT\u00ae-Enterprise: from 3.0;0 before 3.07.01; NEXUS Series: from 3.0;0 before 3.07.01; MATRIX Series: from 3.0;0 before 3.07.01."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1391",
"description": "CWE-1391: Use of Weak Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T14:27:48.422Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"source": {
"advisory": "ABBVREP0088",
"discovery": "UNKNOWN"
},
"title": "Privilege escalation to root",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2023-0635",
"datePublished": "2023-06-05T03:42:04.704Z",
"dateReserved": "2023-02-02T07:19:48.321Z",
"dateUpdated": "2025-01-08T16:42:53.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3010 (GCVE-0-2022-3010)
Vulnerability from cvelistv5 – Published: 2024-01-02 18:32 – Updated: 2025-06-04 19:17
VLAI
EPSS
VEX
Title
Predictable SSH credentials in Priva TopControl Suite
Summary
The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-08 18:43 UTC
CWE
- CWE-1391 - Use of Weak Credentials
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://csirt.divd.nl/CVE-2022-3010 | third-party-advisory |
| https://www.cisa.gov/news-events/ics-advisories/i… | third-party-advisory |
| https://csirt.divd.nl/DIVD-2022-00035 | related |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Priva | TopControl Suite - Bacnet |
Affected:
All versions prior to 8.7.8.0 , < 8.7.8.0
(y.x.z.z)
|
|
| Priva | TopControl Suite - Blue ID |
Affected:
All versions prior to 8.7.8.0 , < 8.7.8.0
(y.x.z)
|
|
| Priva | TopControl Suite - Compass |
Affected:
All versions prior to 8.7.8.0 , < 8.7.8.0
(y.x.z)
|
|
| Priva | TopControl Suite - Connect |
Affected:
All versions prior to 8.7.8.0 , < 8.7.8.0
(y.x.z)
|
|
| Priva | TopControl Suite - TPC |
Affected:
All versions prior to 8.7.8.0 , < 8.7.8.0
(y.x.z)
|
Date Public
2022-12-22 11:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:53:00.594Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://csirt.divd.nl/CVE-2022-3010"
},
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-356-01"
},
{
"tags": [
"related",
"x_transferred"
],
"url": "https://csirt.divd.nl/DIVD-2022-00035"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3010",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-08T18:43:54.412823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T14:45:39.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TopControl Suite - Bacnet",
"vendor": "Priva",
"versions": [
{
"lessThan": "8.7.8.0",
"status": "affected",
"version": "All versions prior to 8.7.8.0",
"versionType": "y.x.z.z"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TopControl Suite - Blue ID",
"vendor": "Priva",
"versions": [
{
"lessThan": "8.7.8.0",
"status": "affected",
"version": "All versions prior to 8.7.8.0",
"versionType": "y.x.z"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TopControl Suite - Compass",
"vendor": "Priva",
"versions": [
{
"lessThan": "8.7.8.0",
"status": "affected",
"version": "All versions prior to 8.7.8.0",
"versionType": "y.x.z"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TopControl Suite - Connect",
"vendor": "Priva",
"versions": [
{
"lessThan": "8.7.8.0",
"status": "affected",
"version": "All versions prior to 8.7.8.0",
"versionType": "y.x.z"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TopControl Suite - TPC",
"vendor": "Priva",
"versions": [
{
"lessThan": "8.7.8.0",
"status": "affected",
"version": "All versions prior to 8.7.8.0",
"versionType": "y.x.z"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "A researcher at NorthWave reported this vulnerability to DIVD."
},
{
"lang": "en",
"type": "analyst",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Victor Pasman (DIVD)"
}
],
"datePublic": "2022-12-22T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Priva TopControl Suite contains\u0026nbsp;predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite."
}
],
"value": "The Priva TopControl Suite contains\u00a0predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite."
}
],
"impacts": [
{
"capecId": "CAPEC-560",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-560 Use of Known Domain Credentials"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1391",
"description": "CWE-1391 Use of Weak Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-04T19:17:57.435Z",
"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"shortName": "DIVD"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/CVE-2022-3010"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-356-01"
},
{
"tags": [
"related"
],
"url": "https://csirt.divd.nl/DIVD-2022-00035"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Priva recommends users to contact their \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.priva.com/buildings/solutions/priva-building-operator#section-04\"\u003esupport team\u003c/a\u003e to upgrade to TopControl Suite version 8.7.8.0 or later.\u003cbr\u003eMinimize network exposure for all control system devices and/or systems, ensure that they are not directly accessible from the internet."
}
],
"value": "Priva recommends users to contact their support team https://www.priva.com/buildings/solutions/priva-building-operator#section-04 \u00a0to upgrade to TopControl Suite version 8.7.8.0 or later.\nMinimize network exposure for all control system devices and/or systems, ensure that they are not directly accessible from the internet."
}
],
"source": {
"advisory": "DIVD-2022-00035",
"discovery": "EXTERNAL"
},
"title": "Predictable SSH credentials in Priva TopControl Suite",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"assignerShortName": "DIVD",
"cveId": "CVE-2022-3010",
"datePublished": "2024-01-02T18:32:22.947Z",
"dateReserved": "2022-08-26T14:53:53.087Z",
"dateUpdated": "2025-06-04T19:17:57.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-2MR3-J246-X7X3
Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-07-25 18:30
VLAI
Details
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-51978"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-25T08:15:31Z",
"severity": "CRITICAL"
},
"details": "An unauthenticated attacker who knows the target device\u0027s serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device\u0027s serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.",
"id": "GHSA-2mr3-j246-x7x3",
"modified": "2025-07-25T18:30:35Z",
"published": "2025-06-26T21:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51978"
},
{
"type": "WEB",
"url": "https://github.com/rapid7/metasploit-framework/pull/20349"
},
{
"type": "WEB",
"url": "https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf"
},
{
"type": "WEB",
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51978.yaml"
},
{
"type": "WEB",
"url": "https://github.com/sfewer-r7/BrotherVulnerabilities"
},
{
"type": "WEB",
"url": "https://support.brother.com/g/b/link.aspx?prod=group2\u0026faqid=faq00100846_000"
},
{
"type": "WEB",
"url": "https://support.brother.com/g/b/link.aspx?prod=group2\u0026faqid=faq00100848_000"
},
{
"type": "WEB",
"url": "https://support.brother.com/g/b/link.aspx?prod=lmgroup1\u0026faqid=faqp00100620_000"
},
{
"type": "WEB",
"url": "https://www.bleepingcomputer.com/news/security/brother-printer-bug-in-689-models-exposes-default-admin-passwords"
},
{
"type": "WEB",
"url": "https://www.darkreading.com/endpoint-security/millions-brother-printers-critical-unpatchable-bug"
},
{
"type": "WEB",
"url": "https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf"
},
{
"type": "WEB",
"url": "https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed"
},
{
"type": "WEB",
"url": "https://www.securityweek.com/new-vulnerabilities-expose-millions-of-brother-printers-to-hacking"
},
{
"type": "WEB",
"url": "https://www.toshibatec.com/information/20250625_02.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3FGM-3M4R-2X8G
Vulnerability from github – Published: 2025-09-18 21:30 – Updated: 2025-09-18 21:30
VLAI
Details
Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker with network access to the device can gain administrative access to the system.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-30519"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-18T21:15:47Z",
"severity": "CRITICAL"
},
"details": "Dover Fueling Solutions ProGauge MagLink LX4 Devices\u00a0have default root credentials that cannot be changed through standard \nadministrative means. An attacker with network access to the device can \ngain administrative access to the system.",
"id": "GHSA-3fgm-3m4r-2x8g",
"modified": "2025-09-18T21:30:57Z",
"published": "2025-09-18T21:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30519"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07"
},
{
"type": "WEB",
"url": "https://www.doverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-47GJ-J96M-3HHG
Vulnerability from github – Published: 2024-02-02 00:31 – Updated: 2025-08-07 21:31
VLAI
Details
Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-1039"
],
"database_specific": {
"cwe_ids": [
"CWE-1391",
"CWE-287",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-01T22:15:55Z",
"severity": "CRITICAL"
},
"details": "Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device.",
"id": "GHSA-47gj-j96m-3hhg",
"modified": "2025-08-07T21:31:03Z",
"published": "2024-02-02T00:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1039"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4XG9-H72C-FXFM
Vulnerability from github – Published: 2025-07-31 06:30 – Updated: 2025-07-31 06:30
VLAI
Details
ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-53558"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T06:15:24Z",
"severity": "HIGH"
},
"details": "ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.",
"id": "GHSA-4xg9-h72c-fxfm",
"modified": "2025-07-31T06:30:32Z",
"published": "2025-07-31T06:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53558"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN66546573"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-624F-P4GG-QWG2
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-05-28 12:30
VLAI
Details
Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number.
This issue was fixed in version 1.00B16CP.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-4377"
],
"database_specific": {
"cwe_ids": [
"CWE-1391"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:39Z",
"severity": "MODERATE"
},
"details": "Dlink\u00a0DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number.\n\nThis issue was fixed in version\u00a01.00B16CP.",
"id": "GHSA-624f-p4gg-qwg2",
"modified": "2026-05-28T12:30:34Z",
"published": "2026-05-28T12:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4377"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2026/05/CVE-2026-4377"
},
{
"type": "WEB",
"url": "https://www.dlink.com/pl/pl/products/dwr-1820-cp#support"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-65FR-GPW6-J777
Vulnerability from github – Published: 2023-05-22 21:30 – Updated: 2024-04-04 04:16
VLAI
Details
Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.
Severity
8.3 (High)
{
"affected": [],
"aliases": [
"CVE-2023-31240"
],
"database_specific": {
"cwe_ids": [
"CWE-1391",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-22T20:15:10Z",
"severity": "CRITICAL"
},
"details": "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nSnap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",
"id": "GHSA-65fr-gpw6-j777",
"modified": "2024-04-04T04:16:46Z",
"published": "2023-05-22T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31240"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01"
},
{
"type": "WEB",
"url": "https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Operation
When the user changes or sets a password, check the password against a database of already compromised or breached passwords. These passwords are likely to be used in password guessing attacks.
No CAPEC attack patterns related to this CWE.