Executive Summary

Summary
Title Harman AMX multimedia devices contain hard-coded credentials
Informations
Name VU#992624 First vendor Publication 2016-01-21
Vendor VU-CERT Last vendor Modification 2016-01-27
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#992624

Harman AMX multimedia devices contain hard-coded credentials

Original Release date: 21 Jan 2016 | Last revised: 27 Jan 2016

Overview

Multiple models of Harman AMX multimedia devices contain a hard-coded debug account.

Description

CWE-798: Use of Hard-coded Credentials - CVE-2015-8362

According to the researchers'blog post, several models of Harman AMX multimedia devices contain a hard-coded "backdoor" account with administrative permissions. Further details are available in the researchers'vulnerability advisory. AMX firmware release notes indicate this was a debugging account left in the released firmware.

The following software versions of the AMX NX-1200 have been reported to be vulnerable:

  • v1.2.322
  • v1.3.100

Affected devices include but are not limited to:
  • AMX NX-1200
  • AMX DGX16-ENC (Digital Media Switchers)
  • AMX DGX32-ENC-A (Digital Media Switchers)
  • AMX DGX64-ENC (Digital Media Switchers)
  • AMX DGX8-ENC (Digital Media Switchers)
  • AMX DVX-2100HD (All-In-One Presentation Switchers)
  • AMX DVX-2210HD (All-In-One Presentation Switchers)
  • AMX DVX-2250HD (All-In-One Presentation Switchers)
  • AMX DVX-2255HD (All-In-One Presentation Switchers)
  • AMX DVX-3250HD (All-In-One Presentation Switchers)
  • AMX DVX-3255HD (All-In-One Presentation Switchers)
  • AMX DVX-3256HD (All-In-One Presentation Switchers)
  • AMX ENOVADGX64-ENC (Digital Media Switchers)
  • AMX MCP-106 (ControlPads)
  • AMX MCP-108 (ControlPads)
  • AMX NI-2000 (Central Controllers)
  • AMX NI-2100 (Central Controllers)
  • AMX NI-3000 (Central Controllers)
  • AMX NI-3100 (Central Controllers)
  • AMX NI-3101-SIG (Central Controllers)
  • AMX NI-4000 (Central Controllers)
  • AMX NI-4100 (Central Controllers)
  • AMX NI-700 (Central Controllers)
  • AMX NI-900 (Central Controllers)
  • AMX NX-1200 (Central Controllers)
  • AMX NX-2200 (Central Controllers)
  • AMX NX-3200 (Central Controllers)
  • AMX NX-4200 (Central Controllers)
  • AMX NXC-ME260-64 (Central Controllers)
  • AMX NXC-MPE (Central Controllers)
  • AMX NetLinx NX Integrated Controller (Media)

Impact

An attacker with knowledge of the account credentials can obtain administrative access on the device.

Solution

Apply an update AMX has released an update for some devices. Affected users are encouraged to contact Harman's support line for more information on obtaining the update.

Restrict network access
Use a firewall or similar technology to restrict access to trusted hosts, networks, and services. Consider operating AMX devices on a separate network segment or VLAN. AMX devices support SSH, HTTP, possibly HTTPS, ICSP, and possibly other services.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
HarmanAffected-21 Jan 2016
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base10.0AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal7.8E:POC/RL:OF/RC:C
Environmental5.9CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

  • http://blog.sec-consult.com/2016/01/deliberately-hidden-backdoor-account-in.html
  • http://www.amx.com/techcenter/NXSecurityBrief/
  • http://www.amx.com/techcenter/firmware.asp?Category=Hot%20Fix%20Files
  • http://seclists.org/fulldisclosure/2016/Jan/63
  • https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20160121-0_AMX_Deliberately_hidden_backdoor_account_v10.txt
  • http://www.amx.com/assets/whitePapers/AMX.AVIT.Administrators.Guide.pdf

Credit

Thanks to Johannes Greil of SEC Consult for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

  • CVE IDs:CVE-2015-8362
  • Date Public:21 Jan 2016
  • Date First Published:21 Jan 2016
  • Date Last Updated:27 Jan 2016
  • Document Revision:39

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/992624

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-255 Credentials Management

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 2

Snort® IPS/IDS

Date Description
2016-04-05 AMX backdoor username login attempt
RuleID : 37917 - Revision : 2 - Type : SERVER-WEBAPP

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
Date Informations
2016-02-02 05:28:13
  • Multiple Updates
2016-01-28 05:27:12
  • Multiple Updates
2016-01-28 05:22:37
  • Multiple Updates
2016-01-28 00:27:09
  • Multiple Updates
2016-01-28 00:22:32
  • Multiple Updates
2016-01-25 21:27:26
  • Multiple Updates
2016-01-22 17:26:30
  • Multiple Updates
2016-01-22 05:26:39
  • Multiple Updates
2016-01-22 05:22:07
  • Multiple Updates
2016-01-22 00:26:09
  • Multiple Updates
2016-01-22 00:21:28
  • First insertion