CWE-259

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:21:27.480Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "21273",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/21273/"
          },
          {
            "name": "20120911 Multiple vulnerabilities in Ezylog photovoltaic management server",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html"
          },
          {
            "name": "sinapsi-default-password(80200)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80200"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "eSolar",
          "vendor": "Sinapsi",
          "versions": [
            {
              "lessThan": "2.0.2870_xxx_2.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "eSolar DUO",
          "vendor": "Sinapsi",
          "versions": [
            {
              "lessThan": "2.0.2870_xxx_2.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "eSolar Light",
          "vendor": "Sinapsi",
          "versions": [
            {
              "lessThan": "2.0.2870_xxx_2.2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Roberto Paleari and Ivan Speziale identified vulnerabilities and released proof-of-concept (exploit) code for the Sinapsi eSolar Light Photovoltaic System Monitor without coordination with Sinapsi or ICS-CERT."
        }
      ],
      "datePublic": "2012-09-11T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "These Sinapsi devices\nstore hard-coded passwords in the PHP file of the device. By using the \nhard-coded passwords in the device, attackers can log into the device \nwith administrative privileges. This could allow the attacker to have \nunauthorized access."
            }
          ],
          "value": "These Sinapsi devices\nstore hard-coded passwords in the PHP file of the device. By using the \nhard-coded passwords in the device, attackers can log into the device \nwith administrative privileges. This could allow the attacker to have \nunauthorized access."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-259",
              "description": "CWE-259",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T15:29:24.539Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "21273",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/21273/"
        },
        {
          "name": "20120911 Multiple vulnerabilities in Ezylog photovoltaic management server",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html"
        },
        {
          "name": "sinapsi-default-password(80200)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80200"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sinapsi has developed a new firmware version 2.0.2870_2.2.12 that \nmitigates these vulnerabilities. Sinapsi released the new firmware on \nMonday, November 19, 2012 directly to the devices. Users will be able to\n manually download the firmware on their device by using the Firmware \nUpdate function in the System Menu in the device\u2019s Web interface. \nSinapsi has also posted a security newsletter to its \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.sinapsitech.it/default.asp?active_page_id=78\u0026amp;news_id=88\"\u003epublic Web site\u003c/a\u003e\u0026nbsp;.\u003cp\u003eOther affected vendors have been notified by Sinapsi and ICS-CERT, \nbut the availability of new firmware upgrades are unknown by ICS-CERT at\n this time.\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Sinapsi has developed a new firmware version 2.0.2870_2.2.12 that \nmitigates these vulnerabilities. Sinapsi released the new firmware on \nMonday, November 19, 2012 directly to the devices. Users will be able to\n manually download the firmware on their device by using the Firmware \nUpdate function in the System Menu in the device\u2019s Web interface. \nSinapsi has also posted a security newsletter to its  public Web site http://www.sinapsitech.it/default.asp \u00a0.Other affected vendors have been notified by Sinapsi and ICS-CERT, \nbut the availability of new firmware upgrades are unknown by ICS-CERT at\n this time."
        }
      ],
      "source": {
        "advisory": "ICSA-12-325-01",
        "discovery": "EXTERNAL"
      },
      "title": "Sinapsi eSolar Hard-Coded Password",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2012-5862",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "login.php on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 establishes multiple hardcoded accounts, which makes it easier for remote attackers to obtain administrative access by leveraging a (1) cleartext password or (2) password hash contained in this script, as demonstrated by a password of astridservice or 36e44c9b64."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "21273",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/21273/"
            },
            {
              "name": "20120911 Multiple vulnerabilities in Ezylog photovoltaic management server",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html"
            },
            {
              "name": "sinapsi-default-password(80200)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80200"
            },
            {
              "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf",
              "refsource": "MISC",
              "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf"
            },
            {
              "name": "http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88",
              "refsource": "CONFIRM",
              "url": "http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2012-5862",
    "datePublished": "2012-11-23T11:00:00.000Z",
    "dateReserved": "2012-11-14T00:00:00.000Z",
    "dateUpdated": "2025-07-08T15:29:24.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-25069"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-07T09:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability.",
  "id": "GHSA-24w2-9p3v-m489",
  "modified": "2024-02-29T03:30:47Z",
  "published": "2023-01-07T09:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25069"
    },
    {
      "type": "WEB",
      "url": "https://advisories.checkpoint.com/advisory/cpai-2018-0721"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.217593"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.217593"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-2061"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259",
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-02T05:15:10Z",
    "severity": "HIGH"
  },
  "details": "Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to obtain a hard-coded password and access to the module via FTP.",
  "id": "GHSA-2fjm-qc6m-8q8h",
  "modified": "2024-04-04T04:28:22Z",
  "published": "2023-06-02T06:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2061"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/vu/JVNVU92908006"
    },
    {
      "type": "WEB",
      "url": "https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2023-004.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/saltbo/zpan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-7453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-16T23:14:11Z",
    "nvd_published_at": "2025-07-11T19:15:23Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. It has been rated as problematic. This issue affects the function NewToken of the file zpan/internal/app/service/token.go of the component JSON Web Token Handler. The manipulation with the input 123 leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-2hfh-94w5-wxvf",
  "modified": "2026-07-16T23:14:11Z",
  "published": "2025-07-11T21:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7453"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saltbo/zpan/issues/219"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saltbo/zpan/pull/410"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saltbo/zpan/commit/8662db8d4b06057631faf3deba4132e66705e947"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/saltbo/zpan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saltbo/zpan/releases/tag/v1.6.6"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.316097"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.316097"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.608447"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ZPan Uses Hard-Coded Password"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-86276"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-07T06:17:24Z",
    "severity": "MODERATE"
  },
  "details": "A flaw has been found in SourceCodester Syllabus-Aligned Learning Management \u0026 Examination System 1.0. This issue affects some unknown processing of the file db.php. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been published and may be used.",
  "id": "GHSA-2hgw-7hf5-vqr6",
  "modified": "2026-09-07T06:30:24Z",
  "published": "2026-09-07T06:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86276"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hackliu/Vulnerability-Reports/blob/master/Syllabus%20Aligned%20Learning%20Management%20Examination%20System/VULN-03-SQL-Injection-Hardcoded-Credentials.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-86276"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/904873"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/399437"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/399437/cti"
    },
    {
      "type": "WEB",
      "url": "https://www.sourcecodester.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-46959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-18T18:15:06Z",
    "severity": "MODERATE"
  },
  "details": "runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1 URI via the rtsp:// protocol to receive the video and audio stream.",
  "id": "GHSA-2jgc-rcc5-7q6j",
  "modified": "2024-09-20T15:30:37Z",
  "published": "2024-09-18T18:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46959"
    },
    {
      "type": "WEB",
      "url": "https://werewolves.world/blog/09072024"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-47823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-27T03:15:22Z",
    "severity": "LOW"
  },
  "details": "Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.",
  "id": "GHSA-2mpq-2wx7-6333",
  "modified": "2025-10-01T15:30:30Z",
  "published": "2025-06-27T03:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47823"
    },
    {
      "type": "WEB",
      "url": "https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems"
    },
    {
      "type": "WEB",
      "url": "https://gainsec.com/2025/06/19/grounded-flight-device-2-root-shell-on-flock-safetys-falcon-sparrow-automated-license-plate-reader"
    },
    {
      "type": "WEB",
      "url": "https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27440"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259",
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-25T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (all firmware versions prior to 02A04.1).",
  "id": "GHSA-2pfh-m36r-gfqc",
  "modified": "2022-10-08T00:00:33Z",
  "published": "2022-05-24T17:45:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27440"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-082-03"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7332"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259",
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-01T01:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-2pxp-hm79-mvqx",
  "modified": "2024-08-01T03:30:46Z",
  "published": "2024-08-01T03:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7332"
    },
    {
      "type": "WEB",
      "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP450/product.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.273255"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.273255"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.378357"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-6039"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259",
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-02T14:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded password may allow unauthorized access to the device.",
  "id": "GHSA-32wr-wj5p-2r78",
  "modified": "2022-05-13T01:36:35Z",
  "published": "2022-05-13T01:36:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6039"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-01"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/98781"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}