CVE-2020-16280 Hardcoded credentials in n/a
Local attackers can read plaintext credentials for administrative and domain users from RangeeOS modules, leading to data exposure and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-16280?
CVE-2020-16280 is a medium-severity vulnerability in n/a, published on 20 Aug 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing administrative services, domain joined users, and local administrators. To exploit the vulnerability a local attacker must have access to the underlying operating system.
Weakness: CWE-522
Which versions are affected by CVE-2020-16280?
It affects 1 product.
Products include Rangee Rangeeos.
How do I fix CVE-2020-16280?
No fix has been published for CVE-2020-16280 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-16280 being exploited?
There is no known exploitation of CVE-2020-16280 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7mcx-vf2q-9wm5.