Description:

CVE-2024-28066 is a vulnerability in Unify CP IP Phone firmware 1.10.4.3 that involves the use of weak credentials, specifically a hardcoded root password. This vulnerability allows unauthorized access to the device, potentially leading to remote code execution and other malicious activities. The SVRS score of 38 indicates a moderate level of risk, highlighting the need for prompt attention.

Key Insights:

• Weak Credentials: The vulnerability stems from the use of a hardcoded root password, which is easily accessible to attackers. This allows them to gain unauthorized access to the device without the need for authentication.
• Remote Code Execution: Once an attacker gains access to the device, they can execute arbitrary code, potentially leading to the installation of malware, data theft, or disruption of services.
• In The Wild: The vulnerability is actively exploited by hackers, making it crucial for organizations to take immediate action to mitigate the risk.

Mitigation Strategies:

• Update Firmware: Apply the latest firmware update from Unify to address the vulnerability.
• Change Default Credentials: Change the default root password to a strong and unique one.
• Enable Two-Factor Authentication: Implement two-factor authentication to add an extra layer of security to the device.
• Monitor Network Traffic: Monitor network traffic for any suspicious activity or unauthorized access attempts.

Additional Information:

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.