CVEvulnerability
CVE-2016-1560
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-04-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-798
Description
ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.
Affected configurations
• exagrid ex3000 firmware 4.8
• exagrid ex5000 firmware 4.8
• exagrid ex7000 firmware 4.8
• exagrid ex10000e firmware 4.8
• exagrid ex13000e firmware 4.8
• exagrid ex21000e firmware 4.8
• exagrid ex32000e firmware 4.8
• exagrid ex40000e firmware 4.8
Related
Weakness · CWE (1)
- CWE-798 Use of Hard-coded Credentials weakness
References
- http://packetstormsecurity.com/files/136634/ExaGrid-Known-SSH-Key-Default-Password.html Exploit, Third Party Advisory, VDB Entry
- http://www.rapid7.com/db/modules/exploit/linux/ssh/exagrid_known_privkey Third Party Advisory
- https://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials Exploit, Mitigation, Third Party Advisory
- http://packetstormsecurity.com/files/136634/ExaGrid-Known-SSH-Key-Default-Password.html Exploit, Third Party Advisory, VDB Entry
- http://www.rapid7.com/db/modules/exploit/linux/ssh/exagrid_known_privkey Third Party Advisory
- https://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials Exploit, Mitigation, Third Party Advisory