Axxon One web client does not force default admin password change
Anyone can log in as admin to this video software with the default password.
Summary
The Axxon One web client does not force a change of the default administrator password on a newly installed system. An unauthenticated remote attacker can log in as administrator with the default credentials; Windows and Linux installs are affected.
Affected when
- Newly installed system with the default administrator password not yet changed
- Web server reachable from the network before the password is changed
What to do
Update to 3.0.0 or later. On earlier versions, change the default administrator password in the desktop client right after installation, before the web server is reachable from the network.
Products and platforms
CVE IDs
Sources
- Advisory: axxonsoft.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen