Black Box iCOMPEL up to 11.1.45 hard-coded credentials

Summaryinfo

A vulnerability classified as critical has been found in Black Box iCOMPEL up to 11.1.45. This affects an unknown function. This manipulation causes hard-coded credentials. This vulnerability is tracked as CVE-2019-15497. The attack is possible to be carried out remotely. No exploit exists. It is advisable to implement restrictive firewalling.

Detailsinfo

A vulnerability classified as critical was found in Black Box iCOMPEL up to 11.1.45. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. The CWE definition for the vulnerability is CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP.

The weakness was disclosed 08/26/2019. This vulnerability is known as CVE-2019-15497 since 08/22/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

Proper firewalling of is able to address this issue.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• ONELAN Net-Top-Box up to 11.1.4

Productinfo

Vendor

• Black Box

Name

• iCOMPEL

Version

• 11.1.0
• 11.1.1
• 11.1.2
• 11.1.3
• 11.1.4
• 11.1.5
• 11.1.6
• 11.1.7
• 11.1.8
• 11.1.9
• 11.1.10
• 11.1.11
• 11.1.12
• 11.1.13
• 11.1.14
• 11.1.15
• 11.1.16
• 11.1.17
• 11.1.18
• 11.1.19
• 11.1.20
• 11.1.21
• 11.1.22
• 11.1.23
• 11.1.24
• 11.1.25
• 11.1.26
• 11.1.27
• 11.1.28
• 11.1.29
• 11.1.30
• 11.1.31
• 11.1.32
• 11.1.33
• 11.1.34
• 11.1.35
• 11.1.36
• 11.1.37
• 11.1.38
• 11.1.39
• 11.1.40
• 11.1.41
• 11.1.42
• 11.1.43
• 11.1.44
• 11.1.45

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion