CVE-2021-27440 Hardcoded credentials in Reason DR60
Attackers can exploit hard-coded credentials in the Reason DR60 to bypass authentication and gain unauthorized access to the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27440?
CVE-2021-27440 is a critical vulnerability in Reason DR60, published on 25 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (all firmware versions prior to 02A04.1).
Which versions are affected by CVE-2021-27440?
It affects 1 product.
Products include Ge Reason Dr60 Firmware.
How do I fix CVE-2021-27440?
No fix has been published for CVE-2021-27440 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27440 being exploited?
There is no known exploitation of CVE-2021-27440 in the wild and no public exploit code.
Other vulnerabilities in Reason DR60
Sources
Also known as GHSA-2pfh-m36r-gfqc.