CVE-2021-27437 Hardcoded credentials in WISE-PaaS/RMM

Critical 9.1 Published 7 May 2021 Updated 3 Aug 2024

Attackers can use hard-coded administrator credentials to access Grafana APIs and obtain sensitive information from the WISE-PaaS dashboard without authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-27437?

CVE-2021-27437 is a critical vulnerability in WISE-PaaS/RMM, published on 7 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM (versions prior to 9.0.1).

Weakness: CWE-798

Which versions are affected by CVE-2021-27437?

It affects 1 product.

Products include Advantech Wise-Paas\/Rmm.

How do I fix CVE-2021-27437?

No fix has been published for CVE-2021-27437 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-27437 being exploited?

There is no known exploitation of CVE-2021-27437 in the wild and no public exploit code.

Sources

Also known as GHSA-6h82-hhr3-9q29.