by Kastro
Paper/Archive/CVE-2021-47744

CVE-2021-47744

Cypress ONE — Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root

EPSS 0.3%public exploitCVSS 9.3
critical.is priorityof 100
43
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 26.0.260 × 205.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the static 'Chameleon' password to gain remote root access via Telnet or SSH on affected devices.

Affected

ProductAffectedFixed inSource
ONE-–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitexploit-db.com/exploits/50407refcypress.bc.cawriteupzeroscience.mk/en/vulnerabilities/ZSL-2021-5686.phpwriteupvulncheck.com/advisories/cypress-solutions-ctm-ctm-one-hard-coded-credentials-remote-root