Description
NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tongcheng-security-team | NextScan | 1.1.0 – ≤ 1.2.0 | — |
References
- https://github.com/tongcheng-security-team/NextScan/issues/50 issue-tracking
- https://hub.docker.com/r/lysec/ns-admin product
- https://vul.yulun.ac.cn/20261107/nextscan/ third-party-advisory
- VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs third-party-advisory