CVE-2020-29376 Hardcoded credentials in n/a

Critical 9.8 Published 29 Nov 2020 Updated 4 Aug 2024

Hardcoded admin password allows attackers to authenticate to the TELNET service on V-SOL OLT devices, gaining full control.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-29376?

CVE-2020-29376 is a critical vulnerability in n/a, published on 29 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. There is an !j@l#y$z%x6x7q8c9z) password for the admin account to authenticate to the TELNET service.

Weakness: CWE-798

Which versions are affected by CVE-2020-29376?

It affects 5 products.

Products include Vsolcn V1600d-Mini Firmware, Vsolcn V1600d4l Firmware, Vsolcn V1600d Firmware, Vsolcn V1600g1 Firmware, Vsolcn V1600g2 Firmware.

How do I fix CVE-2020-29376?

No fix has been published for CVE-2020-29376 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-29376 being exploited?

There is no known exploitation of CVE-2020-29376 in the wild and no public exploit code.

Sources

Also known as GHSA-7qxp-7cvx-2478.