CVE-2018-18929

HIGH

Seneca HDn Firmware < 7.0.4.104 - Use of Hard-coded Credentials in Unattend.xml

Title source: llm
STIX 2.1

Description

The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username and password can leverage it to gain administrator-level access on the system.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0111
EPSS Percentile 61.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-798
Status published
Products (1)
trms/seneca_hdn_firmware < 7.0.4.104
Published Oct 29, 2019
Tracked Since Feb 18, 2026