CVE-2020-10275
The access tokens for the REST API are directly derived from the publicly available default credentials for the web inte
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.
CRITICAL · CVSS 9.8
EPSS 0.0017
Schedule remediation
- CVSS base score ≥ 7.0
Sigma rules0
YARA rules0