Shenzhen Tuoshi NR500-EA SSH Service Vulnerability with Hard-Coded Root Account

A vulnerability exists in Shenzhen Tuoshi NR500-EA devices running firmware RG500UEAABxCOMSLICv3.4.2731.16.43. The SSH service is enabled by default, and there is a hidden hard-coded root account that cannot be disabled through the graphical user interface. This vulnerability allows remote access to the device with root privileges.

Impact

Exploitation of this vulnerability allows remote access to the device via SSH with root privileges, using hard-coded credentials. This could lead to unauthorized modifications, potential execution of malicious commands, and complete control over the device.