POSIM EVO for Windows
Use of Hard-Coded Database Credentials
CVE ID
Vendor
POSIM, LLC
Product
POSIM EVO for Windows
Product Version
15.13
Vulnerability Details
POSIM EVO for Windows includes a file named “Juniper.jar” that contains files with hard coded database credentials for the “root” user. “root” access to POSIM EVO’s database may result in a breach of confidentiality, integrity, availability or allow for attackers to remotely execute code on associated POSIM EVO clients.
Vendor Response
POSIM has not remediated the vulnerability.
Disclosure Timeline
-
Disclosed to Vendor
-
Disclosures forwarded to development
-
Development still working on both issues
-
Publicly disclosed at BSides ATL
