VulnerabilityModified

CVE-2009-3710

RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq!us3r) for an SSH tunnel, which allows remote attackers to gain privileges via port 8022.

HIGH 10.0EPSS 8.50%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (8.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq!us3r) for an SSH tunnel, which allows remote attackers to gain privileges via port 8022.

CVSS 2.0: 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS: 8.50% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-255
Affected: riorey/rios
Source: cve@mitre.org

References

http://osvdb.org/58858
http://packetstormsecurity.org/0910-exploits/riorey-passwd.txtExploit
http://secunia.com/advisories/36971Vendor Advisory
http://osvdb.org/58858
http://packetstormsecurity.org/0910-exploits/riorey-passwd.txtExploit
http://secunia.com/advisories/36971Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.