Default OpenIDM admin password let researchers unlock and start cars
Two unnamed brands fixed the consoles in about two hours; a permitted test also exposed location and telemetry.
Stories per day · 30 days
Relatedconnected-cars2danfoss2forgerock2ot-security2refrigeration2account-takeover1android1command-execution1copeland1database1docker1exasol1internet-exposed1openidm1path-traversal1ping-identity1supermarket1supermarkets1
7 stories, newest first · one card per story
Stories tagged #default-credentials
Freezer-control hacks disrupt about 700 French supermarkets
An October 11 attack forced long defrost cycles on Danfoss, Dixell and Copeland systems, causing millions of euros in damage.
1
Researchers remotely commanded cars through two automakers’ Android apps
Chains used ForgeRock defaults and WAF path-traversal bypasses; both unnamed automakers patched within two hours of disclosure.
Exasol Database 7.1.30 docker-db default SYS credential enables command execution
The docker-db image ships a default SYS credential that reaches os.popen through a PYTHON3 UDF.
Fridge hack costing millions and sparking fires stemmed from poor security
Poorly secured supermarket refrigeration controllers were mass-hacked, causing fires and huge reported losses across Europe.
3
[0day-rubbish] Lightstreamer Server 7.4.8 Shipped placeholder JMX/RMI credentials plus MLet remote class loading to root RCE (9.8)
Lightstreamer Server 7.4.8 ships placeholder JMX credentials that enable remote class loading and root code execution.
[0day-rubbish] TigerGraph Community Edition 4.2.4 Default credentials plus GSQL TO_CSV arbitrary file write to SSH code execution (9.8)
TigerGraph Community Edition 4.2.4 default credentials and GSQL file write enable unauthenticated SSH command execution.