CVE-2015-7921
Last modified
CVE-2015-7921 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials.. EPSS estimates a 1.97% chance of exploitation in the next 30 days.
Description
The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Proface Gp-Pro Ex Ex-Ed | <= 4.0.4 |
| Schneider-Electric | Proface Gp-Pro Ex Pfxexedls | <= 4.0.4 |
| Schneider-Electric | Proface Gp-Pro Ex Pfxexedv | <= 4.0.4 |
| Schneider-Electric | Proface Gp-Pro Ex Pfxexgrpls | <= 4.0.4 |
References
- https://ics-cert.us-cert.gov/advisories/ICSA-16-096-01Third Party Advisory, US Government Resource
- https://ics-cert.us-cert.gov/advisories/ICSA-16-096-01Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-7921?
How severe is CVE-2015-7921?
How do I fix CVE-2015-7921?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-7915Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleart…
- CVE-2015-7916Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F…6.5
- CVE-2015-7917Untrusted search path vulnerability in Open Automation OPC S…
- CVE-2015-7918Multiple buffer overflows in the F1BookView ActiveX control …
- CVE-2015-7919SearchBlox 8.3 before 8.3.1 allows remote attackers to write…
- CVE-2015-7920Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2015-7922Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2015-7923Westermo WeOS before 4.19.0 uses the same SSL private key ac…
- CVE-2015-7924eWON devices with firmware before 10.1s0 do not trigger the …
- CVE-2015-7925Cross-site request forgery (CSRF) vulnerability on eWON devi…
- CVE-2015-7926eWON devices with firmware before 10.1s0 omit RBAC for I/O s…
- CVE-2015-7927Cross-site scripting (XSS) vulnerability on eWON devices wit…
Are you affected by CVE-2015-7921?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST