CVE-2017-7576
Last modified
CVE-2017-7576 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username of energetic and password of wireless) meant to allow the vendor to access the devices. These credentials can be used in the web interface or by connecting to the device via TELNET. EPSS estimates a 1.26% chance of exploitation in the next 30 days.
Description
DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username of energetic and password of wireless) meant to allow the vendor to access the devices. These credentials can be used in the web interface or by connecting to the device via TELNET. This is fixed in recent versions including 1.4.8.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dragonwavex | Horizon Wireless Radio Firmware | 1.01.03 |
References
- http://blog.iancaling.com/post/159276197313/Third Party Advisory
- http://blog.iancaling.com/post/159276197313/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-7576?
How severe is CVE-2017-7576?
How do I fix CVE-2017-7576?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-7569In vBulletin before 5.3.0, remote attackers can bypass the C…
- CVE-2017-7570PivotX 2.3.11 allows remote authenticated Advanced users to …
- CVE-2017-7571public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impac…8
- CVE-2017-7572The _checkPolkitPrivilege function in serviceHelper.py in Ba…
- CVE-2017-7574Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Ele…9.8
- CVE-2017-7575Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow …9.8
- CVE-2017-7577XiongMai uc-httpd has directory traversal allowing the readi…
- CVE-2017-7578Multiple heap-based buffer overflows in parser.c in libming …
- CVE-2017-7579inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the ques…
- CVE-2017-7581SQL injection vulnerability in NewsController.php in the New…
- CVE-2017-7583ILIAS before 5.2.3 has XSS via SVG documents.
- CVE-2017-7584Memory Corruption Vulnerability in Foxit PDF Toolkit before …
Are you affected by CVE-2017-7576?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST