CVE-2018-15807 Hardcoded credentials in n/a
Attackers can bypass login prompts in POSIM EVO by generating a deterministic override code for the hidden administrative account.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-15807?
CVE-2018-15807 is a high-severity vulnerability in n/a, published on 23 Aug 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
POSIM EVO 15.13 for Windows includes an "Emergency Override" administrative account that may be accessed through POSIM's "override" feature. This Override prompt expects a code that is computed locally using a deterministic algorithm. This code may be generated by an attacker and used to bypass any POSIM EVO login prompt.
Weakness: CWE-330
Which versions are affected by CVE-2018-15807?
It affects 1 product.
Products include Posim Evo.
How do I fix CVE-2018-15807?
No fix has been published for CVE-2018-15807 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-15807 being exploited?
There is no known exploitation of CVE-2018-15807 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5wwr-75ff-wp92.