CVE Vulnerability Advisory Database

[Affected Scope] Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1

[Impact] Unauthenticated remote attackers can leverage hardcoded credentials to gain unauthorized root-level access and establish persistence on the underlying operating system

[Mitigation] Immediately upgrade to version 6.0.3.1 HF1 or later, or apply strict network access controls

[Affected Scope] Gladinet CentreStack and Triofox solutions prior to version 16.12.10420.56791

[Impact] Unauthenticated remote attackers can exploit hardcoded AES keys to read arbitrary local files and potentially achieve full system compromise

[Mitigation] Immediately upgrade to version 16.12.10420.56791 or later and restrict access to publicly exposed endpoints

[Affected Scope] Gladinet CentreStack versions through 16.1.10296.56315

[Impact] Unauthenticated remote code execution (RCE) via deserialization of malicious payloads using the hardcoded machineKey, actively exploited in the wild

[Mitigation] Immediately upgrade to version 16.4.10315.56368 or later, or manually delete/rotate the hardcoded machineKey in the portal web.config file

[Affected Scope] Cisco Smart Licensing Utility (CSLU) versions prior to 2.3.0

[Impact] Unauthenticated remote attackers can gain full administrative access to the CSLU application API using hardcoded static credentials

[Mitigation] Immediately upgrade CSLU to version 2.3.0 or later, and restrict external access to the CSLU API ports using firewalls

[Affected Scope] SolarWinds Web Help Desk (WHD) 12.8.3 and prior versions

[Impact] Remote unauthenticated attackers can exploit hardcoded credentials to access internal functionality and modify sensitive data.

[Mitigation] Immediately apply the official SolarWinds 12.8.3 Hotfix 2 or later, and restrict external network access.

[Affected Scope] All firmware versions of End-of-Life (EOL) D-Link NAS models DNS-320L, DNS-325, DNS-327L, and DNS-340L

[Impact] Unauthenticated remote attackers can leverage hardcoded credentials and inject arbitrary system commands to achieve full system compromise

[Mitigation] Since these products are no longer supported, it is strongly recommended to immediately retire and replace the affected devices

[Affected Scope] All firmware versions of legacy D-Link NAS models DNS-320L, DNS-325, DNS-327L, and DNS-340L.

[Impact] Remote unauthenticated attackers can bypass authentication using hard-coded credentials, leading to complete system compromise and arbitrary code execution.

[Mitigation] Since these devices are End-of-Life (EOL) and will not receive security patches, they must be immediately decommissioned and replaced.

[Affected Scope] Unitronics Vision and Samba PLCs and HMIs configured using VisiLogic versions prior to 9.9.00

[Impact] Unauthenticated remote attackers with network access can exploit default administrative credentials to gain full control of the target system

[Mitigation] Upgrade VisiLogic to version 9.9.00 or later, change default passwords immediately, and restrict external network exposure

[Affected Scope] Acclaim Systems USAHERDS through version 7.4.0.1

[Impact] Attackers can exploit hard-coded credentials to bypass authentication and achieve remote code execution (RCE)

[Mitigation] Immediately upgrade to the patched version and restrict external network access to the application

[Affected Scope] FortiOS versions 6.0.4 and below, and 5.6.8 and below, when configuration backups are taken without a custom password

[Impact] An attacker with access to the backup file can decrypt sensitive data, including user passwords, private key passphrases, and High Availability (HA) passwords, using the hard-coded key

[Mitigation] Upgrade FortiOS to patched versions and enforce custom password encryption for all configuration backups