CVE-2014-9614: Critical severity Netsweeper Netsweeper vulnerability

Q: Which deployments are exposed to this issue?

Netsweeper versions before 4.0.5 are affected if the branding account still uses its default password, branding. The exposed access point is the Web Panel at webadmin/.

Q: What does an attacker need to exploit it?

A remote attacker can attempt to authenticate to webadmin/ using the known default branding account credentials. No prior privileges or user interaction are required according to the supplied severity vector.

Q: What should be done if an immediate upgrade is not possible?

Change the branding account password from the default value and restrict remote access to the webadmin/ interface. Upgrading to version 4.0.5 or later removes exposure from affected earlier versions.

Published Feb 19, 2020

Updated

The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/.

Affected Software

1 affected component

Netsweeper Netsweeper<4.0.5

Event History

Feb 19, 2020

CVE Published

via MITRE·07:56 PM

Data Sourced

via MITRE·07:56 PM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

Netsweeper versions before 4.0.5 are affected if the branding account still uses its default password, branding. The exposed access point is the Web Panel at webadmin/.

What does an attacker need to exploit it?

A remote attacker can attempt to authenticate to webadmin/ using the known default branding account credentials. No prior privileges or user interaction are required according to the supplied severity vector.

What should be done if an immediate upgrade is not possible?

Change the branding account password from the default value and restrict remote access to the webadmin/ interface. Upgrading to version 4.0.5 or later removes exposure from affected earlier versions.

CVE-2014-9614: Critical severity Netsweeper Netsweeper vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should be done if an immediate upgrade is not possible?