search menu icon-carat-right cmu-wordmark

CERT Coordination Center

OpenELEC and RasPlex have a hard-coded SSH root password

Vulnerability Note VU#544527

Original Release Date: 2016-02-02 | Last Revised: 2016-02-02

Overview

OpenELEC and derivatives utilize a hard-coded default root password, and enable SSH root access by default.

Description

CWE-259: Use of Hard-coded Password

OpenELEC has a hard-coded root password. The root partition is by default read-only, preventing a user from changing the password once installed; furthermore, SSH access is enabled by default.

RasPlex is based on OpenELEC and therefore inherits this same problem.

According to RasPlex, "The root filesystem is read only (squashfs). This prevents the ability to change the root password, but also prevents an attacker from modifying the filesystem."

Impact

A remote attacker may gain root access to the device.

Solution

The CERT/CC is currently unaware of a full solution to this issue. Affected users may consider the following mitigations:

Disable SSH password access

Disable the use of password access to SSH, and enable SSH keys instead.

RasPlex notes that "users can simply disable SSH via the dialog if they are worried about being compromised."

Build with a different password

Developers may build their own distribution of OpenELEC or RasPlex from source and modify the root password at build time. Users should be aware however that this password is still hard-coded and may leave a user vulnerable to further attack; future password changes would require another rebuild and deployment.

Restrict network access

Use a firewall or similar technology to restrict access to trusted hosts, networks, and services.

Vendor Information

544527
 
Affected   Unknown   Unaffected

OpenELEC

Updated:  January 29, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

RasPlex

Updated:  January 29, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal 8.5 E:POC/RL:U/RC:UR
Environmental 2.1 CDP:ND/TD:L/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Aidan Samuel for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs: None
Date Public: 2016-02-02
Date First Published: 2016-02-02
Date Last Updated: 2016-02-02 16:20 UTC
Document Revision: 24

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.