CVE-2018-19275 Hardcoded credentials in n/a

Critical 9.8 Published 2 Apr 2019 Updated 5 Aug 2024

Remote attackers can use default credentials in Mitel InAttend and CMG Suite Servers to gain unauthorized access and execute arbitrary scripts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-19275?

CVE-2018-19275 is a critical vulnerability in n/a, published on 2 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access and execute arbitrary scripts with potential impacts to the confidentiality, integrity and availability of the system.

Weakness: CWE-1188

Which versions are affected by CVE-2018-19275?

It affects 2 products.

Products include Mitel Cmg Suite, Mitel Inattend.

How do I fix CVE-2018-19275?

No fix has been published for CVE-2018-19275 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-19275 being exploited?

There is no known exploitation of CVE-2018-19275 in the wild and no public exploit code.

Sources

Also known as GHSA-97v5-h9x8-c8wj.