CVE-2024-25825

FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the root password saved…

Critical · published October 9, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

🚨 A wildcard root password means anyone can gain full control with ZERO effort on FydeOS systems! 🔥 This is like leaving the front door to your house wide open with a sign that says 'Welcome, no keys needed!' — it's an invitation for trouble! With root access, an attacker could wreak havoc by installing malicious software, stealing sensitive information, or even locking you out completely. The consequences could be absolutely devastating, from lost data to compromised systems, and it’s all too easy for them!

Put simply

This is like leaving the front door to your house wide open with a sign that says 'Welcome, no keys needed!' — it's an invitation for trouble! The vulnerability in FydeOS lies in the configuration where the root password is saved as a wildcard, allowing attackers to bypass authentication and access the system unrestricted.

What to do

With root access, an attacker could wreak havoc by installing malicious software, stealing sensitive information, or even locking you out completely. The consequences could be absolutely devastating, from lost data to compromised systems, and it’s all too easy for them! Immediately update to the latest versions of FydeOS (17.1 R115 or higher) and ensure that proper password policies are enforced. Regularly audit your configurations to avoid future security pitfalls. You've got this! Follow these steps and become the security hero your system deserves! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00533 · 44.2th percentile
Published
2024-10-09T00:00Z
EPSS history
Timeline
  • 09 OCT 00:00Z
    FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the root password saved…
    cvelistv5