CVE-2012-4697

TURCK BL20 Programmable Gateway and BL67 Programmable Gateway have hardcoded accounts, which allows remote attackers to obtain administrative access via an FTP…

published May 23, 2013

CVSS
—
EPSS
2%
Percentile
82.8
In the wild
Unconfirmed
What it is

⚠️ Hardcoded accounts are like leaving the keys to the kingdom under the doormat! With TURCK's BL20 and BL67 Gateways, attackers can simply stroll in via FTP to take control. 🔑 Think of it like a hotel with a master key that isn't changed between guests. Anyone can waltz in and access any room without a second thought because the key is just sitting there, waiting to be used! If an attacker discovers and uses these hardcoded credentials, they could gain administrative access, potentially wreaking havoc on your entire system! This could lead to unauthorized data access, manipulation, or even the complete takeover of connected devices.

Put simply

Think of it like a hotel with a master key that isn't changed between guests. Anyone can waltz in and access any room without a second thought because the key is just sitting there, waiting to be used! The TURCK BL20 and BL67 Programmable Gateways have hardcoded FTP accounts that allow remote attackers to easily authenticate and gain administrative privileges, bypassing any standard security measures.

What to do

If an attacker discovers and uses these hardcoded credentials, they could gain administrative access, potentially wreaking havoc on your entire system! This could lead to unauthorized data access, manipulation, or even the complete takeover of connected devices. To protect yourself, immediately change the default credentials to something more secure and consider disabling FTP if it’s not necessary. Regularly audit system access and permissions to ensure that no unauthorized users have access. You’ve got this! With a few simple steps, you can lock down your gateways and keep your systems secure! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02251 · 82.8th percentile
Published
2013-05-23T17:00Z
EPSS history
Timeline
  • 23 MAY 17:00Z
    TURCK BL20 Programmable Gateway and BL67 Programmable Gateway have hardcoded accounts, which allows remote attackers to obtain administrative access via an FTP…
    cvelistv5