Common Weakness Enumeration
CWE-1392
AllowedUse of Default Credentials
Abstraction: Base · Status: Incomplete
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
218 vulnerabilities reference this CWE, most recent first.
CVE-2024-39584 (GCVE-0-2024-39584)
Vulnerability from cvelistv5 – Published: 2024-08-28 05:46 – Updated: 2024-08-28 14:15
VLAI
EPSS
VEX
Summary
Dell Client Platform BIOS contains a Use of Default Cryptographic Key Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Secure Boot bypass and arbitrary code execution.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-28 14:02 UTC
CWE
- CWE-1392 - Use of Default Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.dell.com/support/kbdoc/en-us/00022759… | vendor-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dell | Dell Client Platform BIOS |
Affected:
N/A , < 1.29.0
(semver)
Affected: N/A , < 1.15.0 (semver) Affected: N/A , < 1.21.0 (semver) Affected: N/A , < 1.24.0 (semver) |
|
| dell | alienware_m17_r3_firmware |
Affected:
0 , < 1.29.0
(semver)
cpe:2.3:o:dell:alienware_area_51m_r2_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:dell:alienware_m15_r3_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:dell:alienware_m17_r3_firmware:-:*:*:*:*:*:*:* |
|
| dell | alienware_aurora_r15_amd_firmware |
Affected:
0 , < 1.15.0
(semver)
cpe:2.3:o:dell:alienware_aurora_r15_amd_firmware:*:*:*:*:*:*:*:* |
|
| dell | alienware_x14_firmware |
Affected:
0 , < 1.21.0
(semver)
cpe:2.3:o:dell:alienware_x14_firmware:-:*:*:*:*:*:*:* |
|
| dell | alienware_x15_r1_firmware |
Affected:
0 , < 1.24.0
(semver)
cpe:2.3:o:dell:alienware_x17_r1_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:dell:alienware_x15_r1_firmware:*:*:*:*:*:*:*:* |
Date Public
2024-08-27 06:30
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:dell:alienware_area_51m_r2_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:alienware_m15_r3_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:alienware_m17_r3_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "alienware_m17_r3_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:alienware_aurora_r15_amd_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "alienware_aurora_r15_amd_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.15.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:alienware_x14_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "alienware_x14_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.21.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:alienware_x17_r1_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:alienware_x15_r1_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "alienware_x15_r1_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39584",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-28T14:02:49.780082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T14:15:01.978Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dell Client Platform BIOS",
"vendor": "Dell",
"versions": [
{
"lessThan": "1.29.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.15.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.21.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.24.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CVE-2024-39584: Dell Technologies would like to thank BINARLY REsearch team for reporting this issue."
}
],
"datePublic": "2024-08-27T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Dell Client Platform BIOS contains a Use of Default Cryptographic Key Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Secure Boot bypass and arbitrary code execution."
}
],
"value": "Dell Client Platform BIOS contains a Use of Default Cryptographic Key Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Secure Boot bypass and arbitrary code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392: Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T05:46:40.013Z",
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.dell.com/support/kbdoc/en-us/000227594/dsa-2024-354"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"assignerShortName": "dell",
"cveId": "CVE-2024-39584",
"datePublished": "2024-08-28T05:46:40.013Z",
"dateReserved": "2024-06-26T02:16:08.993Z",
"dateUpdated": "2024-08-28T14:15:01.978Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31069 (GCVE-0-2024-31069)
Vulnerability from cvelistv5 – Published: 2024-04-12 15:18 – Updated: 2024-08-02 01:46
VLAI
EPSS
VEX
Title
IOSIX IO-1020 Micro ELD Use of Default Credentials
Summary
IO-1020 Micro ELD web server uses a default password for authentication.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-10 20:10 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IOSiX | IO-1020 Micro ELD |
Affected:
0 , ≤ 360
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31069",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-10T20:10:19.735101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-10T20:10:31.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:46:04.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-093-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IO-1020 Micro ELD",
"vendor": "IOSiX",
"versions": [
{
"lessThanOrEqual": "360",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jake Jepson of Colorado State University reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nIO-1020 Micro ELD web server uses a default password for authentication.\n\n"
}
],
"value": "IO-1020 Micro ELD web server uses a default password for authentication.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 ",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-12T15:18:39.220Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-093-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\u003cp\u003eIOSIX recommends users update to 360.\u003c/p\u003e\n\u003cp\u003eFor further support, contact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www2.iosix.com/support-2/\"\u003eIOSiX\u003c/a\u003e.\n\n\u003c/p\u003e"
}
],
"value": "IOSIX recommends users update to 360.\n\nFor further support, contact IOSiX https://www2.iosix.com/support-2/ .\n\n"
}
],
"source": {
"advisory": "ICSA-24-093-01",
"discovery": "EXTERNAL"
},
"title": "IOSIX IO-1020 Micro ELD Use of Default Credentials",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-31069",
"datePublished": "2024-04-12T15:18:39.220Z",
"dateReserved": "2024-03-28T18:24:04.631Z",
"dateUpdated": "2024-08-02T01:46:04.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-30210 (GCVE-0-2024-30210)
Vulnerability from cvelistv5 – Published: 2024-04-12 15:16 – Updated: 2024-08-02 01:25
VLAI
EPSS
VEX
Title
IOSIX IO-1020 Micro ELD Use of Default Credentials
Summary
IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-26 19:55 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IOSiX | IO-1020 Micro ELD |
Affected:
0 , ≤ 360
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-30210",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-26T19:55:51.404174Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-26T19:56:01.581Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:25:03.339Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-093-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IO-1020 Micro ELD",
"vendor": "IOSiX",
"versions": [
{
"lessThanOrEqual": "360",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jake Jepson of Colorado State University reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nIO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device.\n\n"
}
],
"value": "IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 ",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-12T15:16:30.094Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-093-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\u003cp\u003eIOSIX recommends users update to 360.\u003c/p\u003e\n\u003cp\u003eFor further support, contact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www2.iosix.com/support-2/\"\u003eIOSiX\u003c/a\u003e.\n\n\u003c/p\u003e"
}
],
"value": "IOSIX recommends users update to 360.\n\nFor further support, contact IOSiX https://www2.iosix.com/support-2/ .\n\n"
}
],
"source": {
"advisory": "ICSA-24-093-01",
"discovery": "EXTERNAL"
},
"title": "IOSIX IO-1020 Micro ELD Use of Default Credentials",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-30210",
"datePublished": "2024-04-12T15:16:30.094Z",
"dateReserved": "2024-03-28T18:24:04.620Z",
"dateUpdated": "2024-08-02T01:25:03.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29844 (GCVE-0-2024-29844)
Vulnerability from cvelistv5 – Published: 2024-04-14 23:48 – Updated: 2024-09-25 22:37
VLAI
EPSS
VEX
Title
Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions
Summary
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-22 17:22 UTC
CWE
- CWE-1392 - Use of Default Credentials
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| CS Technologies Australia | Evolution Controller |
Affected:
2.x
|
|
| cs_technologies | evolution_controller |
Affected:
0 , ≤ 2.04.560.31.03.2024
(custom)
cpe:2.3:a:cs_technologies:evolution_controller:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cs_technologies:evolution_controller:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "evolution_controller",
"vendor": "cs_technologies",
"versions": [
{
"lessThanOrEqual": "2.04.560.31.03.2024",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29844",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-22T17:22:59.657234Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T15:50:37.525Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:17:57.988Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Evolution Controller",
"vendor": "CS Technologies Australia",
"versions": [
{
"status": "affected",
"version": "2.x"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password."
}
],
"value": "Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There is no warning or prompt to ask the user to change the default password."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-25T22:37:13.799Z",
"orgId": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
"shortName": "directcyber"
},
"references": [
{
"url": "https://directcyber.com.au/sa/CVE-2024-29836-to-29844-evolution-controller-multiple-vulnerabilities.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
"assignerShortName": "directcyber",
"cveId": "CVE-2024-29844",
"datePublished": "2024-04-14T23:48:26.802Z",
"dateReserved": "2024-03-21T00:52:45.515Z",
"dateUpdated": "2024-09-25T22:37:13.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27158 (GCVE-0-2024-27158)
Vulnerability from cvelistv5 – Published: 2024-06-14 03:24 – Updated: 2025-02-13 17:46
VLAI
EPSS
VEX
Title
Hardcoded root password
Summary
All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-14 16:48 UTC
CWE
- CWE-1392 - Use of Default Credentials
Assigner
References
Impacted products
51 products
| Vendor | Product | Version | |
|---|---|---|---|
| Toshiba Tec Corporation | Toshiba Tec e-Studio multi-function peripheral (MFP) |
Affected:
see the reference URL
|
|
| toshibatec | e-studio-2521_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2521_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2020_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2020_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2520_nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2520_nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2021_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2021_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3025_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3025_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3525_acg |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3525_acg:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5525_acg |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5525_acg:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6525_acg |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6525_acg:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3028-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3028-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3528-ag |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3528-ag:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4528-ag |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4528-ag:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6526-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6526-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6527-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6527-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-7527-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-7527-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6529-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6529-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-7529-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-7529-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-9029-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-9029-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-330-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-330-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-400-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-400-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2010-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2010-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2110-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2110-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2510-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2510-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2610-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2610-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2015-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2015-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2515-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2515-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2615-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2615-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3015-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3015-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3115-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3115-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3515-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3515-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3615-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3615-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4515_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4515_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4615_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4615_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5015_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5015_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5115_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5115_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2018_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2018_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2518_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2518_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2618_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2618_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3018_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3018_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3118_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3118_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3118_ag |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3118_ag:-:*:*:*:*:*:*:* |
Date Public
2024-06-14 02:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2521_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2521_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2020_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2020_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2520_nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2520_nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2021_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2021_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3025_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3025_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3525_acg:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3525_acg",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5525_acg:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5525_acg",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6525_acg:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6525_acg",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3028-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3028-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3528-ag:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3528-ag",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4528-ag:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4528-ag",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6526-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6526-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6527-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6527-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-7527-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-7527-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6529-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6529-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-7529-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-7529-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-9029-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-9029-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-330-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-330-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-400-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-400-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2010-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2010-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2110-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2110-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2510-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2510-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2610-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2610-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2015-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2015-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2515-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2515-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2615-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2615-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3015-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3015-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3115-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3115-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3515-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3515-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3615-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3615-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4515_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4515_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4615_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4615_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5015_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5015_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5115_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5115_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2018_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2018_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2518_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2518_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2618_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2618_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3018_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3018_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3118_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3118_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3118_ag:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3118_ag",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27158",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-14T16:48:07.304069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T19:51:25.249Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.739Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "see the reference URL"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
}
],
"datePublic": "2024-06-14T02:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL."
}
],
"value": "All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e"
}
],
"value": "We are not aware of any malicious exploitation by these vulnerabilities."
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-04T05:06:19.648Z",
"orgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"shortName": "Toshiba"
},
"references": [
{
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e"
}
],
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2024-06-14T02:00:00.000Z",
"value": "Fixes will be released"
}
],
"title": "Hardcoded root password",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users.\u003cbr\u003e"
}
],
"value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"assignerShortName": "Toshiba",
"cveId": "CVE-2024-27158",
"datePublished": "2024-06-14T03:24:23.225Z",
"dateReserved": "2024-02-21T02:11:56.736Z",
"dateUpdated": "2025-02-13T17:46:04.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-13893 (GCVE-0-2024-13893)
Vulnerability from cvelistv5 – Published: 2025-03-06 14:01 – Updated: 2025-03-06 14:47
VLAI
EPSS
VEX
Title
Shared credentials in Smartwares cameras
Summary
Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet service. Hash of the password can be retrieved through physical access to SPI connected memory.
For the telnet service to be enabled, the inserted SD card needs to have a folder with a specific name created.
Two products were tested, but since the vendor has not replied to reports, patching status remains unknown, as well as groups of devices and firmware ranges in which the same password is shared.
Newer firmware versions might be vulnerable as well.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-06 14:47 UTC
CWE
- CWE-1392 - Use of Default Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/en/posts/2025/03/CVE-2024-13892/ | third-party-advisory |
| https://www.smartwares.eu/en-gb/smartwares-cip-37… | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Smartwares | CIP-37210AT |
Affected:
0 , ≤ 3.3.0
(semver)
|
|
| Smartwares | C724IP |
Affected:
0 , ≤ 3.3.0
(semver)
|
Date Public
2025-03-06 11:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-13893",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-06T14:47:05.509002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-06T14:47:20.695Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "CIP-37210AT",
"vendor": "Smartwares",
"versions": [
{
"lessThanOrEqual": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"product": "C724IP",
"vendor": "Smartwares",
"versions": [
{
"lessThanOrEqual": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Micha\u0142 Majchrowicz (Afine Team)"
},
{
"lang": "en",
"type": "finder",
"value": "Marcin Wyczechowski (Afine Team)"
}
],
"datePublic": "2025-03-06T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Smartwares cameras\u0026nbsp;CIP-37210AT and\u0026nbsp;C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet service. Hash of the password can be retrieved through physical access to SPI connected memory.\u003cbr\u003eFor the telnet service to be enabled, the inserted SD card needs to have a folder with a specific name created.\u0026nbsp;\u003cbr\u003eTwo products were tested, but since the vendor has not replied to reports, patching status remains unknown, as well as groups of devices and firmware ranges in which the same password is shared.\u003cbr\u003e Newer firmware versions might be vulnerable as well.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Smartwares cameras\u00a0CIP-37210AT and\u00a0C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet service. Hash of the password can be retrieved through physical access to SPI connected memory.\nFor the telnet service to be enabled, the inserted SD card needs to have a folder with a specific name created.\u00a0\nTwo products were tested, but since the vendor has not replied to reports, patching status remains unknown, as well as groups of devices and firmware ranges in which the same password is shared.\n Newer firmware versions might be vulnerable as well."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-06T14:04:35.995Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2025/03/CVE-2024-13892/"
},
{
"tags": [
"product"
],
"url": "https://www.smartwares.eu/en-gb/smartwares-cip-37210at-indoor-wi-fi-camera-cip--37210at"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Shared credentials in Smartwares cameras",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2024-13893",
"datePublished": "2025-03-06T14:01:06.389Z",
"dateReserved": "2025-02-20T14:05:40.498Z",
"dateUpdated": "2025-03-06T14:47:20.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12902 (GCVE-0-2024-12902)
Vulnerability from cvelistv5 – Published: 2024-12-23 10:16 – Updated: 2024-12-24 02:01
VLAI
EPSS
VEX
Title
Global Wisdom Software ANCHOR - Undocumented Privileged Account
Summary
ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the virtual machine using the default credentials.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-24 02:00 UTC
CWE
- CWE-1392 - Use of Default Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-8314-983c9-1.html | third-party-advisory |
| https://www.twcert.org.tw/en/cp-139-8315-e6069-2.html | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Global Wisdom Software | ANCHOR |
Affected:
2.5.* , < 2.5.9.5
(custom)
Affected: 2.7.* , < 2.7.2.4 (custom) |
Date Public
2024-12-23 10:16
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12902",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T02:00:47.389277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T02:01:08.577Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ANCHOR",
"vendor": "Global Wisdom Software",
"versions": [
{
"lessThan": "2.5.9.5",
"status": "affected",
"version": "2.5.*",
"versionType": "custom"
},
{
"lessThan": "2.7.2.4",
"status": "affected",
"version": "2.7.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-12-23T10:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the virtual machine using the default credentials."
}
],
"value": "ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the virtual machine using the default credentials."
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-23T10:16:33.272Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8314-983c9-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8315-e6069-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Modify the default password manually or apply the following updates to automatically change the default password:\u003cbr\u003eFor the 2.5 series, please update to version 2.5.9.5 or later.\u003cbr\u003eFor the 2.7 series, please update to version 2.7.2.4 or later.\u003cbr\u003e\u003cbr\u003eFor remote access, versions 2.5.3.1 and later and versions 2.7 series have disabled the SMB service by default and restricted high-privilege service accounts from remote login via RDP and WinRM services.\u003cbr\u003eIf you need to use the following services, it is recommended to set up a firewall to restrict IP sources:\u003cbr\u003e135 (RPC), 139 (NetBIOS), 445 (SMB), 3389 (RDP), 5985 (WinRM).\u003cbr\u003e"
}
],
"value": "Modify the default password manually or apply the following updates to automatically change the default password:\nFor the 2.5 series, please update to version 2.5.9.5 or later.\nFor the 2.7 series, please update to version 2.7.2.4 or later.\n\nFor remote access, versions 2.5.3.1 and later and versions 2.7 series have disabled the SMB service by default and restricted high-privilege service accounts from remote login via RDP and WinRM services.\nIf you need to use the following services, it is recommended to set up a firewall to restrict IP sources:\n135 (RPC), 139 (NetBIOS), 445 (SMB), 3389 (RDP), 5985 (WinRM)."
}
],
"source": {
"advisory": "TVN-202412007",
"discovery": "EXTERNAL"
},
"title": "Global Wisdom Software ANCHOR - Undocumented Privileged Account",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-12902",
"datePublished": "2024-12-23T10:16:33.272Z",
"dateReserved": "2024-12-23T02:27:53.261Z",
"dateUpdated": "2024-12-24T02:01:08.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12856 (GCVE-0-2024-12856)
Vulnerability from cvelistv5 – Published: 2024-12-27 16:03 – Updated: 2025-11-22 12:22 X_Known Exploited Vulnerability
VLAI
EPSS
VEX
Title
Four-Faith Industrial Router adjust_sys_time OS Command Injection
Summary
The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.
Severity
7.2 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-28 15:24 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://vulncheck.com/blog/four-faith-cve-2024-12856 | exploittechnical-description |
| https://vulncheck.com/advisories/four-faith-time | third-party-advisory |
| https://ducklingstudio.blog.fc2.com/blog-entry-392.html | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Four-Faith | F3x24 |
Affected:
2.0
cpe:2.3:a:four-faith:f3x24:2.0:*:*:*:*:*:*:* |
|
| Four-Faith | F3x36 |
Affected:
2.0
cpe:2.3:a:four-faith:f3x36:2.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12856",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-28T15:24:33.511503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-28T15:24:42.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vulncheck.com/blog/four-faith-cve-2024-12856"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "F3x24",
"vendor": "Four-Faith",
"versions": [
{
"status": "affected",
"version": "2.0"
}
]
},
{
"defaultStatus": "unknown",
"product": "F3x36",
"vendor": "Four-Faith",
"versions": [
{
"status": "affected",
"version": "2.0"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:four-faith:f3x24:2.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:four-faith:f3x36:2.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue.\u003cbr\u003e"
}
],
"value": "The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-22T12:22:39.876Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://vulncheck.com/blog/four-faith-cve-2024-12856"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://vulncheck.com/advisories/four-faith-time"
},
{
"tags": [
"exploit"
],
"url": "https://ducklingstudio.blog.fc2.com/blog-entry-392.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "Four-Faith Industrial Router adjust_sys_time OS Command Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-12856",
"datePublished": "2024-12-27T16:03:04.567Z",
"dateReserved": "2024-12-20T16:13:34.537Z",
"dateUpdated": "2025-11-22T12:22:39.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-12286 (GCVE-0-2024-12286)
Vulnerability from cvelistv5 – Published: 2024-12-10 17:40 – Updated: 2024-12-11 14:13
VLAI
EPSS
VEX
Title
MOBATIME Network Master Clock has a use of default credentials vulnerability
Summary
MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-11 14:12 UTC
CWE
- CWE-1392 - Use of Default Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MOBATIME | Network Master Clock - DTS 4801 |
Affected:
00020419.01.02020154
|
Date Public
2024-12-10 17:10
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-11T14:12:56.145380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-11T14:13:07.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Network Master Clock - DTS 4801",
"vendor": "MOBATIME",
"versions": [
{
"status": "affected",
"version": "00020419.01.02020154"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mate Csorba and Zoltan Kato from DNV reported this vulnerability to CISA."
}
],
"datePublic": "2024-12-10T17:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eMOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials.\u003c/span\u003e"
}
],
"value": "MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-10T17:40:02.566Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eMOBATIME recommends users update to the latest firmware version from their \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.mobatime.com/resource/282/dts-4801-masterclock\"\u003ehomepage\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "MOBATIME recommends users update to the latest firmware version from their homepage https://www.mobatime.com/resource/282/dts-4801-masterclock ."
}
],
"source": {
"advisory": "ICSA-24-345-01",
"discovery": "EXTERNAL"
},
"title": "MOBATIME Network Master Clock has a use of default credentials vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-12286",
"datePublished": "2024-12-10T17:40:02.566Z",
"dateReserved": "2024-12-05T21:43:21.355Z",
"dateUpdated": "2024-12-11T14:13:07.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12013 (GCVE-0-2024-12013)
Vulnerability from cvelistv5 – Published: 2025-02-13 16:03 – Updated: 2025-02-13 16:53
VLAI
EPSS
VEX
Summary
A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform changes over resources exposed by the service such as configuration files where password hashes are saved or where network settings are stored.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-13 16:53 UTC
CWE
- CWE-1392 - Use of Default Credentials
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12013",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-13T16:53:11.220388Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-13T16:53:17.702Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "130.8005",
"vendor": "Zettler",
"versions": [
{
"status": "affected",
"version": "12h",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Diego Zaffaroni of Nozomi Networks found this bug during a security research activity."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A CWE-1392 \u201cUse of Default Credentials\u201d was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform changes over resources exposed by the service such as configuration files where password hashes are saved or where network settings are stored."
}
],
"value": "A CWE-1392 \u201cUse of Default Credentials\u201d was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform changes over resources exposed by the service such as configuration files where password hashes are saved or where network settings are stored."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of Default Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-13T16:03:02.948Z",
"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
"shortName": "Nozomi"
},
"references": [
{
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-12013"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
"assignerShortName": "Nozomi",
"cveId": "CVE-2024-12013",
"datePublished": "2025-02-13T16:03:02.948Z",
"dateReserved": "2024-12-02T10:29:14.254Z",
"dateUpdated": "2025-02-13T16:53:17.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
Mitigation
Architecture and Design
Force the administrator to change the credential upon installation.
Mitigation
Installation
Operation
The product administrator could change the defaults upon installation or during operation.
No CAPEC attack patterns related to this CWE.