Vulnerability Note VU#992624

Harman AMX multimedia devices contain hard-coded credentials

Original Release date: 21 Jan 2016 | Last revised: 27 Jan 2016


Multiple models of Harman AMX multimedia devices contain a hard-coded debug account.


CWE-798: Use of Hard-coded Credentials - CVE-2015-8362

According to the researchers' blog post, several models of Harman AMX multimedia devices contain a hard-coded "backdoor" account with administrative permissions. Further details are available in the researchers' vulnerability advisory. AMX firmware release notes indicate this was a debugging account left in the released firmware.

The following software versions of the AMX NX-1200 have been reported to be vulnerable:

  • v1.2.322
  • v1.3.100

Affected devices include but are not limited to:
  • AMX NX-1200
  • AMX DGX16-ENC (Digital Media Switchers)
  • AMX DGX32-ENC-A (Digital Media Switchers)
  • AMX DGX64-ENC (Digital Media Switchers)
  • AMX DGX8-ENC (Digital Media Switchers)
  • AMX DVX-2100HD (All-In-One Presentation Switchers)
  • AMX DVX-2210HD (All-In-One Presentation Switchers)
  • AMX DVX-2250HD (All-In-One Presentation Switchers)
  • AMX DVX-2255HD (All-In-One Presentation Switchers)
  • AMX DVX-3250HD (All-In-One Presentation Switchers)
  • AMX DVX-3255HD (All-In-One Presentation Switchers)
  • AMX DVX-3256HD (All-In-One Presentation Switchers)
  • AMX ENOVADGX64-ENC (Digital Media Switchers)
  • AMX MCP-106 (ControlPads)
  • AMX MCP-108 (ControlPads)
  • AMX NI-2000 (Central Controllers)
  • AMX NI-2100 (Central Controllers)
  • AMX NI-3000 (Central Controllers)
  • AMX NI-3100 (Central Controllers)
  • AMX NI-3101-SIG (Central Controllers)
  • AMX NI-4000 (Central Controllers)
  • AMX NI-4100 (Central Controllers)
  • AMX NI-700 (Central Controllers)
  • AMX NI-900 (Central Controllers)
  • AMX NX-1200 (Central Controllers)
  • AMX NX-2200 (Central Controllers)
  • AMX NX-3200 (Central Controllers)
  • AMX NX-4200 (Central Controllers)
  • AMX NXC-ME260-64 (Central Controllers)
  • AMX NXC-MPE (Central Controllers)
  • AMX NetLinx NX Integrated Controller (Media)


An attacker with knowledge of the account credentials can obtain administrative access on the device.


Apply an update AMX has released an update for some devices. Affected users are encouraged to contact Harman's support line for more information on obtaining the update.

Restrict network access
Use a firewall or similar technology to restrict access to trusted hosts, networks, and services. Consider operating AMX devices on a separate network segment or VLAN. AMX devices support SSH, HTTP, possibly HTTPS, ICSP, and possibly other services.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
HarmanAffected-21 Jan 2016
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal 7.8 E:POC/RL:OF/RC:C
Environmental 5.9 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND



Thanks to Johannes Greil of SEC Consult for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

  • CVE IDs: CVE-2015-8362
  • Date Public: 21 Jan 2016
  • Date First Published: 21 Jan 2016
  • Date Last Updated: 27 Jan 2016
  • Document Revision: 39


If you have feedback, comments, or additional information about this vulnerability, please send us email.