Detections
Analytics

Barracuda Appliances Default Credentials

high Nessus Plugin ID 64258

Language:

Synopsis

An account on the remote host uses a default password.

Description

The account 'product' or 'emailswitch' is using a default password. A remote, unauthenticated attacker could exploit this to log in as an unprivileged user. After logging in, an attacker can log into the local MySQL server as root without a password. Additionally, getting access to a root shell is trivial.

It is also likely that this host allows remote logins using the 'root', 'cluster', and 'remote' accounts using public key authentication, but Nessus has not checked for those issues.

Solution

Upgrade to Security Definition 2.0.5 or later.

Note that this fix does not disable access to the root, cluster, or remote accounts.

See Also

https://seclists.org/fulldisclosure/2013/Jan/220

https://www.barracuda.com/support#41

Plugin Details

Severity: High

ID: 64258

File Name: barracuda_default_accounts.nasl

Version: 1.20

Type: remote

Published: 1/28/2013

Updated: 7/11/2022

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Score was rationalized for non-admin default device credentials.

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: manual

CVSS v3

Risk Factor: High

Base Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Vulnerability Information

Excluded KB Items: global_settings/supplied_logins_only

Exploit Ease: No exploit is required

Patch Publication Date: 1/23/2013

Vulnerability Publication Date: 1/24/2013

Reference Information

BID: 57537