Critical ICSA-21-350-01 1 CVE

Xylem AquaView

Published Dec 16, 2021 · Updated Dec 16, 2021

Vendor: Xylem Product: AquaView

Summary

Successful exploitation of this vulnerability could allow an authenticated local attacker to create users, delete users, disable user groups, and update the system and its security levels.

Vulnerabilities 1

Critical 9.3

CVE-2021-42833

Use of hardcoded credentials impacting AquaView versions 1.60, 7.x, 8.x

A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate users and system settings.

Feb 7, 2022

Revision history

2021-12-16 #1
ICSA-21-350-01 Xylem AquaView

References

ICS Advisory ICSA-21-350-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-350-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B