Default WebUI passwords stored in plaintext
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.4.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The vulnerability affects the web-based management interface of the affected device, whose shipped template database stores the factory default passwords for all five account types in plaintext. Because these default passwords are identical across devices and may remain unchanged after setup, an attacker could potentially use them to gain unauthorized administrative access.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- msi-image
Version range not reported
- WebUI
fixed in 1.4.7