Thermo Fisher Torrent Suite Weak Default Credentials Vulnerability

A vulnerability exists in the Thermo Fisher Torrent Suite Django application version 5.18.1, due to weak default credentials stored as fixtures for the Django ORM API. The 'ionadmin' user account can authenticate to default deployments using the password 'ionadmin'. Although the user guide advises changing default credentials, there is no enforced policy to ensure password changes for default administrative accounts. As a result, many deployments may still use these default credentials, allowing an attacker to gain administrative access.

Impact

Exploitation of this vulnerability allows unauthorized access to the application with administrative privileges.

Remediation

Users are advised to change the default 'ionadmin' password and ensure that all accounts have unique passwords. For guidance on password security, refer to the 'Password security recommendations for Torrent Suite Software' section in the Torrent Suite Software User Guide. Additionally, consult the 'Network Configuration and Security' section of the user guide to review and update network setup as needed.