Blue Angel Software Suite Hardcoded Credential Vulnerability on Embedded Linux

A vulnerability exists in the Blue Angel Software Suite used on embedded Linux systems, due to hardcoded credentials that grant administrative access to the device's web interface. The application includes several default and hardcoded user accounts, which are not documented publicly. These accounts enable unauthenticated or low-privilege attackers to access administrative features.

Impact

Exploitation of this vulnerability allows for unauthorized administrative access to the device's web interface.

Reproduction

The vulnerability can be reproduced by logging into the device using one of the hardcoded accounts. Once logged in, command execution can be performed through the web interface by exploiting the authenticated command execution vulnerability in the 'ping' command.