CVE-2017-14728 Hardcoded credentials in n/a
Attackers can bypass authentication and gain administrative access due to hardcoded credentials and lack of forced password changes in SiteOmat BOS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-14728?
CVE-2017-14728 is a critical vulnerability in n/a, published on 3 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public.
Weakness: CWE-798
Which versions are affected by CVE-2017-14728?
It affects 1 product.
Products include Orpak Siteomat.
How do I fix CVE-2017-14728?
No fix has been published for CVE-2017-14728 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-14728 being exploited?
There is no known exploitation of CVE-2017-14728 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8ghv-f82m-w39j.