title: hard coded credentials in elvexys ISOS firmwares
description: ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.
affected:
{
defaultStatus: unaffected
product: ISOS
vendor: elvexys
versions:
lessThanOrEqual: 2.00, status: affected, version: 1.81, versionType: patch
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: ISOS firmwares from version 2.01 force the user to change the default credentials during the first login.
For
ISOS fimwares up to version 2.00, the default credentials must be
changed by the user as documented in the « Initial staging » and « User
access » chapters.