A vulnerability was found in Zingbox Inspector up to 1.294. It has been rated as critical. Affected by this issue is an unknown function of the component SSH Service. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. When combined with PAN-SA-2019-0027, this can allow an attacker to authenticate to the service using hardcoded credentials.

The weakness was shared 10/09/2019. This vulnerability is handled as CVE-2019-15017 since 08/13/2019. The attack needs to approached within the local network. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1110.001 by the MITRE ATT&CK project.

Addressing this vulnerability is possible by firewalling .

The entries VDB-143238, VDB-143237, VDB-143236 and VDB-143235 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Zingbox

Name

• Inspector

Version

• 1.294

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion