by Kastro
Paper/Archive/CVE-2020-37135

CVE-2020-37135

Amssplus AMSS++ — AMSS++ 4.7 - Backdoor Admin Account

EPSS 0.5%public exploitCVSS 9.3
critical.is priorityof 100
46
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 41.6.416 × 208.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

AMSS++ 4.7 contains an authentication bypass vulnerability that allows attackers to access administrative accounts using hardcoded credentials. Attackers can log in with the default admin username and password '1234' to gain unauthorized administrative access to the system.

Affected

ProductAffectedFixed inSource
AMSS++4.7–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/48114writeupvulncheck.com/advisories/amss-backdoor-admin-account