CVE-2018-18929 Hardcoded credentials in n/a
Attackers can gain administrator access by extracting default credentials from a leftover Sysprep file on the device.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18929?
CVE-2018-18929 is a high-severity vulnerability in n/a, published on 29 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username and password can leverage it to gain administrator-level access on the system.
Weakness: CWE-798
Which versions are affected by CVE-2018-18929?
It affects 1 product.
Products include Trms Seneca Hdn Firmware.
How do I fix CVE-2018-18929?
No fix has been published for CVE-2018-18929 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-18929 being exploited?
There is no known exploitation of CVE-2018-18929 in the wild and no public exploit code.
Sources
Also known as GHSA-xmc6-5pwj-wqwj.