id: CVE-2020-35338 info: name: Wireless Multiplex Terminal Playout Server <=20.2.8 - Default Credential Detection author: Jeya Seelan severity: critical description: Wireless Multiplex Terminal Playout Server <=20.2.8 has a default account with a password of pokon available via its web administrative interface. impact: | An attacker can exploit this vulnerability to gain unauthorized access to the server. remediation: | Change the default credentials to strong and unique ones. reference: - https://jeyaseelans.medium.com/cve-2020-35338-9e841f48defa - https://nvd.nist.gov/vuln/detail/CVE-2020-35338 - https://www.mobileviewpoint.com/ - https://github.com/ARPSyndicate/cvemon - https://github.com/ARPSyndicate/kenzer-templates classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-35338 cwe-id: CWE-798 epss-score: 0.2493 epss-percentile: 0.96665 cpe: cpe:2.3:a:mobileviewpoint:wireless_multiplex_terminal_playout_server:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: mobileviewpoint product: wireless_multiplex_terminal_playout_server tags: cve,cve2020,wmt,default-login,mobileviewpoint http: - method: GET path: - "{{BaseURL}}/server/" headers: Authorization: "Basic OnBva29u" matchers-condition: and matchers: - type: word words: - "WMT Server playout" - type: status status: - 200 # digest: 4a0a00473045022100bc50d4afe23ea33ae214e9a6ed2d16702561177aef949c0b88e96bf25b51558802200f9b1b62e778b927f3ffa9baa5c2ef58e43976a9a6b15a4e80a8111135652ccd:922c64590222798bb761d5b6d8e72950