The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update files. There is no option for deleting or changing their passwords for an enduser. An attacker can use the credentials to log into the device. Authentication can be performed via SSH backdoor or likely via physical access (UART shell).
References
Configurations
No configuration.
History
03 Nov 2025, 20:19
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2025-05-21 12:16
Updated : 2025-11-03 20:19
NVD link : CVE-2025-48413
Mitre link : CVE-2025-48413
CVE.ORG link : CVE-2025-48413
JSON object : View
Products Affected
No product.
CWE
CWE-798
Use of Hard-coded Credentials