CVE Vulnerabilities

CVE-2020-14011

Initialization of a Resource with an Insecure Default

Published: Jun 15, 2020 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless Built-in admin is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features.

Weakness

The product initializes or sets a resource with a default that is intended to be changed by the product’s installer, administrator, or maintainer, but the default is not secure.

Affected Software

Name Vendor Start Version End Version
Lansweeper Lansweeper 6.0.0.19 (including) 7.2.108.6 (including)

References