CVE-2021-27438 Hardcoded credentials in Reason DR60
The Reason DR60 contains hard-coded passwords for authentication, allowing attackers to bypass security controls and potentially take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27438?
CVE-2021-27438 is a high-severity vulnerability in Reason DR60, published on 25 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (all firmware versions prior to 02A04.1).
Which versions are affected by CVE-2021-27438?
It affects 1 product.
Products include Ge Reason Dr60 Firmware.
How do I fix CVE-2021-27438?
No fix has been published for CVE-2021-27438 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27438 being exploited?
There is no known exploitation of CVE-2021-27438 in the wild and no public exploit code.
Other vulnerabilities in Reason DR60
Sources
Also known as GHSA-j9p3-5r25-x4hg.