Anevia Flamingo XL/XS Default/Hard-coded Credentials Vulnerability (ZSL-2023-5777)

Critical Vulnerability Information Title: Anevia Flamingo XL/XS 3.6.x Default/Hard-coded Credentials Advisory ID: ZSL-2023-5777 Type: Local/Remote Impact: Privilege Escalation, System Access, Denial of Service Risk: 4/5 Release Date: 11.06.2023 Summary Flamingo XL is a new modular, high-density IPTV headend product designed for the hotel and enterprise markets. It captures live TV and broadcast content from satellite, cable, digital terrestrial, and analog sources, and delivers it over IP networks to STBs, PCs, or other IP-connected devices. Description The device employs weak default and hard-coded administrative credentials that are easily guessable in remote password attacks, allowing attackers to gain control of the system. Affected Versions 3.6.20, 3.2.9 Hardware Revision 1.1, 1.0 SoapLive 2.4.1, 2.0.3 SoapSystem 1.3.1 Tested Environments GNU/Linux 3.14.29 (x86_64) Apache/2.2.22 (Debian) PHP/5.6.0 Vendor Status [13.04.2023] Vulnerability discovered [13.04.2023] Contacted vendor [10.06.2023] Vendor unresponsive [11.06.2023] Public security advisory released PoC anevia_creds.txt Acknowledgments Vulnerability discovered by Gjoko Krstic - gjoko@zeroscience.mk References [1] https://packetstormsecurity.com/files/172875/Anevia-Flamingo-XL-XS-3.6.x-Default-Hardcoded-Credentials.html [2] https://exchange.xforce.ibmcloud.com/vulnerabilities/259059 [3] https://cxsecurity.com/issue/WLB-2023060019

Goal Reached Thanks to every supporter — we hit 100%!

Anevia Flamingo XL/XS Default/Hard-coded Credentials Vulnerability (ZSL-2023-5777)