critical9.8Public exploit code
CVE-2016-1560
ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ExaGrid - Known SSH Key and Default Password (Metasploit)2016-04-07 · remote · linux · Verified
Impact
ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Exagrid | Ex3000 Firmware | Version 4.8 |
| Exagrid | Ex5000 Firmware | Version 4.8 |
| Exagrid | Ex7000 Firmware | Version 4.8 |
| Exagrid | Ex10000e Firmware | Version 4.8 |
| Exagrid | Ex13000e Firmware | Version 4.8 |
| Exagrid | Ex21000e Firmware | Version 4.8 |
| Exagrid | Ex32000e Firmware | Version 4.8 |
| Exagrid | Ex40000e Firmware | Version 4.8 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/136634/ExaGrid-Known-SSH-Key-Default-Password.html
- http://www.rapid7.com/db/modules/exploit/linux/ssh/exagrid_known_privkey
- https://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials
- http://packetstormsecurity.com/files/136634/ExaGrid-Known-SSH-Key-Default-Password.html
- http://www.rapid7.com/db/modules/exploit/linux/ssh/exagrid_known_privkey
- https://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials