CVE-2022-30271 Hardcoded credentials in n/a
Attackers can use a hardcoded SSH private key to gain unauthorized access to Motorola ACE1000 RTUs, potentially leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-30271?
CVE-2022-30271 is a critical vulnerability in n/a, published on 26 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no private-key file exists. Thus, this hardcoded key is likely to be used by default.
Which versions are affected by CVE-2022-30271?
It affects 1 product.
Products include Motorola Ace1000 Firmware.
How do I fix CVE-2022-30271?
No fix has been published for CVE-2022-30271 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-30271 being exploited?
There is no known exploitation of CVE-2022-30271 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-59rw-g46v-6c42.