CVE-2021-47744 Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root
Attackers can gain remote root access via Telnet or SSH using hard-coded credentials on Cypress Solutions CTM devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47744?
CVE-2021-47744 is a critical vulnerability in Cypress ONE, published on 31 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the static 'Chameleon' password to gain remote root access via Telnet or SSH on affected devices.
Weakness: CWE-798
Which versions are affected by CVE-2021-47744?
How do I fix CVE-2021-47744?
No fix has been published for CVE-2021-47744 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-47744 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47744 exists.
Sources
Also known as GHSA-v245-m4vw-4545.