#VU25403 Improper Authentication in Vantage Velocity - CVE-2020-9023
Published: February 17, 2020
Vulnerability identifier: #VU25403
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2020-9023
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Vantage Velocity
Vantage Velocity
Software vendor:
Iteris, Inc.
Iteris, Inc.
Description
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the affected devices have two users that are not documented and are configured with weak passwords (User bluetooth, password bluetooth; User eclipse, password eclipse). Also, bluetooth is the root password. A remote attacker can bypass authentication process and gain unauthorized access to the application.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.