Improper Authentication in Vantage Velocity - CVE-2020-9023
Published: February 17, 2020
Vulnerability identifier: #VU25403
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2020-9023
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Iteris, Inc.
Affected software:
Vantage Velocity
Vantage Velocity
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the affected devices have two users that are not documented and are configured with weak passwords (User bluetooth, password bluetooth; User eclipse, password eclipse). Also, bluetooth is the root password. A remote attacker can bypass authentication process and gain unauthorized access to the application.
How to mitigate CVE-2020-9023
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.