CVE-2009-2357 Hardcoded credentials in n/a
Default TekRADIUS configuration uses privileged SQL credentials, allowing remote attackers to access the database and Windows OS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2009-2357?
CVE-2009-2357 is a critical vulnerability in n/a, published on 7 Jul 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The default configuration of TekRADIUS 3.0 uses the sa account to communicate with Microsoft SQL Server, which makes it easier for remote attackers to obtain privileged access to the database and the underlying Windows operating system.
Weakness: CWE-16
Which versions are affected by CVE-2009-2357?
It affects 1 product.
Products include Yasinkaplan Tekradius.
How do I fix CVE-2009-2357?
No fix has been published for CVE-2009-2357 yet. Limit exposure of the affected software until one is available.
Is CVE-2009-2357 being exploited?
There is no known exploitation of CVE-2009-2357 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-v93g-jrxq-6qr3.