The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite.
Solution:
The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
| Link | Tags |
|---|---|
| https://csirt.divd.nl/CVE-2022-3010 | third party advisory broken link |
| https://www.cisa.gov/news-events/ics-advisories/icsa-22-356-01 | third party advisory us government resource |
| https://csirt.divd.nl/DIVD-2022-00035 | broken link related |