CVE-2015-7921

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://ics-cert.us-cert.gov/advisories/ICSA-16-096-01Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-16-096-01Third Party Advisory, US Government Resource

Timeline

Published: Apr 6, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-79239.0Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-mi CVE-2015-79248.8eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes CVE-2015-79258.0Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentic CVE-2015-79269.9eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain s CVE-2015-79276.1Cross-site scripting (XSS) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script CVE-2015-79288.5eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote at CVE-2015-79294.3eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive informati CVE-2015-793010.0Adcon Telemetry A840 Telemetry Gateway Base Station has hardcoded credentials, which allows remote attackers to obtain administrative access CVE-2015-79318.7The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-mid CVE-2015-79328.6Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network.CVE-2015-79348.6The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecifie CVE-2015-79357.5Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.