CVE-2021-22667: Advantech BB-ESWGP506-2SFP-T Use of Hard-coded Credentials Remote Code Execution Vulnerability
BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unauthorized access and permit the execution of arbitrary code on the BB-ESWGP506-2SFP-T (versions 1.01.01 and prior).
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech BB-ESWGP506-2SFP-T industrial switches. Authentication is not required to exploit this vulnerability. The specific flaw exists within the telnet service, which listens on TCP port 23 by default. The service contains a hard-coded password for the administrator user account. An attacker can leverage this vulnerability to execute code in the context of the administrator user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-22667?
CVE-2021-22667 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Advantech BB-ESWGP506-2SFP-T industrial switches.
How severe is CVE-2021-22667?
CVE-2021-22667 has a severity rating of 9.8 (Critical).
Is authentication required to exploit CVE-2021-22667?
No, authentication is not required to exploit CVE-2021-22667.
What is the specific flaw within CVE-2021-22667?
The specific flaw within CVE-2021-22667 is a vulnerability in the telnet service, which listens on TCP port 23 by default.
How can I fix CVE-2021-22667?
To fix CVE-2021-22667, apply the necessary security patches provided by Advantech.