CVE-2014-9614

CRITICALNuclei

Netsweeper 4.0.5 - Default Weak Account

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2014-9614 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryCRITICALNetsweeper 4.0.5 - Default Weak AccountCVSS 9.8

The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/.

Impact

An attacker can gain unauthorized access to the Netsweeper 4.0.5 system using the default weak account.

Remediation

Change the default credentials to strong and unique ones.

WeaknessesCWE-798
Authorsdaffainfo
Template tagscve2014cvenetsweeperdefault-loginpacketstormxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*
https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz https://nvd.nist.gov/vuln/detail/CVE-2014-9614 http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2