CVE-2021-37555 Hardcoded credentials in n/a
Attackers can gain root shell access via Telnet using hardcoded credentials, allowing full device control and filesystem extraction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37555?
CVE-2021-37555 is a critical vulnerability in n/a, published on 26 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is used on port 23 with the default password of 059AnkJ for the root account. The user can then download the filesystem through preinstalled BusyBox utilities (e.g., tar and nc).
Weakness: CWE-798
Which versions are affected by CVE-2021-37555?
It affects 1 product.
Products include Trixie Tx9 Automatic Food Dispenser Firmware.
How do I fix CVE-2021-37555?
No fix has been published for CVE-2021-37555 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-37555 being exploited?
There is no known exploitation of CVE-2021-37555 in the wild and no public exploit code.
Sources
Also known as GHSA-3gff-7mjm-8jv9.