CVE-2019-20025 Hardcoded credentials in n/a
Unauthenticated attackers can log in with hardcoded manufacturer credentials to gain full control of NEC SV9100 PBX devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-20025?
CVE-2019-20025 is a critical vulnerability in n/a, published on 29 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain builds of NEC SV9100 software could allow an unauthenticated, remote attacker to log into a device running an affected release with a hardcoded username and password, aka a Static Credential Vulnerability. The vulnerability is due to an undocumented user account with manufacturer privilege level. An attacker could exploit this vulnerability by using this account to remotely log into an affected device. A successful exploit could allow the attacker to log into the device with manufacturer level access. This vulnerability affects SV9100 PBXes that are running software release 6.0 or higher. This vulnerability does not affect SV9100 software releases prior to 6.0.
Weakness: CWE-798
Which versions are affected by CVE-2019-20025?
It affects 1 product.
Products include Nec Sv9100 Firmware.
How do I fix CVE-2019-20025?
No fix has been published for CVE-2019-20025 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-20025 being exploited?
There is no known exploitation of CVE-2019-20025 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7q4r-vh4x-gr7v.