CVE-2009-1477 Hardcoded credentials in n/a
Remote attackers can decrypt HTTPS sessions on ATEN IP KVM switches by using a hardcoded SSL private key extracted from another device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2009-1477?
CVE-2009-1477 is a critical vulnerability in n/a, published on 27 May 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The https web interfaces on the ATEN KH1516i IP KVM switch with firmware 1.0.063, the KN9116 IP KVM switch with firmware 1.1.104, and the PN9108 power-control unit have a hardcoded SSL private key, which makes it easier for remote attackers to decrypt https sessions by extracting this key from their own switch and then sniffing network traffic to a switch owned by a different customer.
Weakness: CWE-310
Which versions are affected by CVE-2009-1477?
It affects 3 products.
Products include Aten Kh1516i Ip Kvm Switch, Aten Kn9116 Ip Kvm Switch, Aten Pn9108 Power Over the Net.
How do I fix CVE-2009-1477?
No fix has been published for CVE-2009-1477 yet. Limit exposure of the affected software until one is available.
Is CVE-2009-1477 being exploited?
There is no known exploitation of CVE-2009-1477 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j9x4-qhm6-3564.