CVE-2019-15497 Hardcoded credentials in n/a
Remote attackers can access Black Box iCOMPEL devices using default credentials, leading to unauthorized control and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15497?
CVE-2019-15497 is a critical vulnerability in n/a, published on 26 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP.
Weakness: CWE-798
Which versions are affected by CVE-2019-15497?
It affects 2 products.
Products include Blackbox Icompel Firmware, Onelan Net-Top-Box Firmware.
How do I fix CVE-2019-15497?
No fix has been published for CVE-2019-15497 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-15497 being exploited?
There is no known exploitation of CVE-2019-15497 in the wild and no public exploit code.
Sources
Also known as GHSA-xgmm-vjx3-4m7q.