Sunbird DCIM dcTrack and Power IQ Hard-Coded Credentials Vulnerability

A vulnerability exists in Sunbird DCIM dcTrack and Power IQ platforms, all versions through 9.2.0, allowing the use of default and hard-coded credentials for access. This vulnerability could enable an attacker to manage the database, escalate privileges on the platform, or execute system commands on the host.

Impact

Exploitation of this vulnerability could lead to unauthorized access, privilege escalation, and the ability to execute system commands on the host.

Remediation

Users are advised to update Sunbird DCIM dcTrack to version 9.2.3 and Power IQ to version 9.2.1. If an immediate update is not possible, Sunbird recommends restricting SSH or any non-essential port access in the IP Based Access Control and changing passwords for SSH-based user accounts at the time of deployment.