CVE-2016-1560

ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

72.29% chance of exploitation in the next 30 days, 99th percentile

Published

2017-04-21

Updated

2024-08-05

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/136634/ExaGrid-Known-SSH-Key-Default-Password.html
• http://www.rapid7.com/db/modules/exploit/linux/ssh/exagrid_known_privkey

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/exagrid_known_privkey.…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/41680

References

• CVE Record
• NVD entry

Related

• CVE-2016-1555
• CVE-2016-1561
• CVE-2016-1548
• CVE-2016-1564
• CVE-2016-1543
• CVE-2016-1575