CVE-2020-35929 Hardcoded credentials in TinyCheck
Hard-coded credentials in the installation script allow attackers to gain unauthorized access to remote data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-35929?
CVE-2020-35929 is a critical vulnerability in Kaspersky TinyCheck, published on 19 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This information could be used by an attacker for unauthorized access to remote data.
Weakness: CWE-798
Which versions are affected by CVE-2020-35929?
It affects 1 product.
Products include Kaspersky Tinycheck.
How do I fix CVE-2020-35929?
No fix has been published for CVE-2020-35929 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-35929 being exploited?
There is no known exploitation of CVE-2020-35929 in the wild and no public exploit code.