Unscored CVE-2017-12577 EUVD-2017-4149GHSA-wwcm-7c7v-g9q6

An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password ("admin:password") is used in the Android application th…

Published Aug 24, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Description

An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password ("admin:password") is used in the Android application that allows attackers to use a hidden API URL "/goform/SystemCommand" to execute any command with root permission.

References

20180821 CVE-2017-12577: an hardcode credential in PLANEX CS-QR20 mailing-list