The TELSAT marKoni FM Transmitter 1.9.5 firmware contains a hidden super administrative account named 'factory' with a hardcoded password 'inokram25', providing unauthorized access to the web management interface configuration. This backdoor account is not visible in the user interface and the password cannot be changed through regular operations. By exploiting this vulnerability located in the /js_files/LogIn_local.js script file, attackers can gain full control over the device, allowing them to perform actions like unit configuration, parameter modification, EEPROM overwrite, clearing DB, and factory log modification.
The Netis E1+ router version 1.2.32533 contains a backdoor account that allows unauthorized access with root privileges. The backdoor account can be accessed using the credentials 'root:abSQTPcIskFGc:0:0:root:/:/bin/sh'. This vulnerability allows an attacker to gain full control over the router and potentially compromise the network.
A silent privileged backdoor account discovered on the Prolink PRS1841 routers; allows attackers to gain command execution privileges to the router OS. The vulnerable account issued by the vendor was identified as "adsl" and "realtek" as the default password; attackers could use this account to access the router remotely/internally using either Telnet or FTP protocol.
Interbase is an open source relational database offered by Borland Inprise Corporation. It contains a backdoor user account and password called 'LOCKSMITH'. When accessed this account will eliminate all implemented security allowing full control of any database and contents within the database, this level of access will allow any function to be performed including modification of objects, root access and execution of arbitrary functions.
In Eltek Management Section, on following path, some json files (sush as cfgUseraccount1.json to cfgUseraccount10.json) will be called, that disclose some of pre-defined system users. The json response is containing username and password (hashed in MD5), if you crack the MD5 hashes to plain text you can be able to login in the system.
The UPS Module has 3 default accounts, (admin,fwupgrade,user) , fwupgrade has a shell access to the device BUT if you try to get access to the shell a shell script closes your conection. To stop the shell script and avoid to terminate your connection you should , set your SSH client to execute "/bin/bash" after you logon the SSH. As a result your shell type will be changed to "/bin/bash" as you see below there is an account called "eurek" and ofcourse it's password also is "eurek". Since that "eurek" is a sudoer user you will get full access to the device.
Services By CQR