published November 18, 2020
⚠️ Default telnet credentials still hang around, and they could let anyone waltz right in! The PLANET Technology Corp NVR-915 and NVR-1615 models shipped with root access enabled. 🔥 It's like leaving your front door unlocked with a big sign saying, 'Come on in, my stuff is all yours!' — anyone can just walk in without even knocking! An attacker could gain full control of the NVR, accessing video feeds, changing settings, or even using it as a pivot point to compromise other devices on the network. Imagine the chaos if a malicious actor decided to play around with surveillance footage or worse!
It's like leaving your front door unlocked with a big sign saying, 'Come on in, my stuff is all yours!' — anyone can just walk in without even knocking! This vulnerability exists because the firmware contains hardcoded default credentials for root access via telnet, and when exposed to the internet, it allows unauthenticated remote access to the device.
An attacker could gain full control of the NVR, accessing video feeds, changing settings, or even using it as a pivot point to compromise other devices on the network. Imagine the chaos if a malicious actor decided to play around with surveillance footage or worse! If you're still using these unsupported models, it's time for a reality check. Disable telnet access, change any existing credentials, and consider upgrading to newer hardware that receives regular updates. Security is a marathon, not a sprint! You've got this! Take action now, and you'll be one step closer to securing your network! 🛡️