CVE-2019-5672 Hardcoded credentials in Jetson TX1 and TX2
NVIDIA Jetson devices ship with default SSH keys, allowing attackers to intercept traffic or impersonate devices if keys are not manually rotated.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5672?
CVE-2019-5672 is a critical vulnerability in NVIDIA Jetson TX1 and TX2, published on 11 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the Secure Shell (SSH) keys provided in the sample rootfs are not replaced by unique host keys after sample rootsfs generation and flashing, which may lead to information disclosure.
Weakness: CWE-320
Which versions are affected by CVE-2019-5672?
It affects 2 products.
Products include Nvidia Jetson Tx1, Nvidia Jetson Tx2.
How do I fix CVE-2019-5672?
No fix has been published for CVE-2019-5672 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5672 being exploited?
There is no known exploitation of CVE-2019-5672 in the wild and no public exploit code.
Sources
Also known as GHSA-rchx-wqgr-v8cg.