search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Harman AMX multimedia devices contain hard-coded credentials

Vulnerability Note VU#992624

Original Release Date: 2016-01-21 | Last Revised: 2016-01-27

Overview

Multiple models of Harman AMX multimedia devices contain a hard-coded debug account.

Description

CWE-798: Use of Hard-coded Credentials - CVE-2015-8362

According to the researchers' blog post, several models of Harman AMX multimedia devices contain a hard-coded "backdoor" account with administrative permissions. Further details are available in the researchers' vulnerability advisory. AMX firmware release notes indicate this was a debugging account left in the released firmware.

The following software versions of the AMX NX-1200 have been reported to be vulnerable:

    • v1.2.322
    • v1.3.100

Affected devices include but are not limited to:
    • AMX NX-1200
    • AMX DGX16-ENC (Digital Media Switchers)
    • AMX DGX32-ENC-A (Digital Media Switchers)
    • AMX DGX64-ENC (Digital Media Switchers)
    • AMX DGX8-ENC (Digital Media Switchers)
    • AMX DVX-2100HD (All-In-One Presentation Switchers)
    • AMX DVX-2210HD (All-In-One Presentation Switchers)
    • AMX DVX-2250HD (All-In-One Presentation Switchers)
    • AMX DVX-2255HD (All-In-One Presentation Switchers)
    • AMX DVX-3250HD (All-In-One Presentation Switchers)
    • AMX DVX-3255HD (All-In-One Presentation Switchers)
    • AMX DVX-3256HD (All-In-One Presentation Switchers)
    • AMX ENOVADGX64-ENC (Digital Media Switchers)
    • AMX MCP-106 (ControlPads)
    • AMX MCP-108 (ControlPads)
    • AMX NI-2000 (Central Controllers)
    • AMX NI-2100 (Central Controllers)
    • AMX NI-3000 (Central Controllers)
    • AMX NI-3100 (Central Controllers)
    • AMX NI-3101-SIG (Central Controllers)
    • AMX NI-4000 (Central Controllers)
    • AMX NI-4100 (Central Controllers)
    • AMX NI-700 (Central Controllers)
    • AMX NI-900 (Central Controllers)
    • AMX NX-1200 (Central Controllers)
    • AMX NX-2200 (Central Controllers)
    • AMX NX-3200 (Central Controllers)
    • AMX NX-4200 (Central Controllers)
    • AMX NXC-ME260-64 (Central Controllers)
    • AMX NXC-MPE (Central Controllers)
    • AMX NetLinx NX Integrated Controller (Media)

Impact

An attacker with knowledge of the account credentials can obtain administrative access on the device.

Solution

Apply an updateAMX has released an update for some devices. Affected users are encouraged to contact Harman's support line for more information on obtaining the update.

Restrict network access
Use a firewall or similar technology to restrict access to trusted hosts, networks, and services. Consider operating AMX devices on a separate network segment or VLAN. AMX devices support SSH, HTTP, possibly HTTPS, ICSP, and possibly other services.

Vendor Information

992624
 
Expand all

Harman Affected

Updated:  January 21, 2016

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Harman AMX has released a firmware update to address this issue; more details in the links below.

Vendor References


CVSS Metrics

Group Score Vector
Base 10 AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal 7.8 E:POC/RL:OF/RC:C
Environmental 5.9 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Acknowledgements

Thanks to Johannes Greil of SEC Consult for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs: CVE-2015-8362
Date Public: 2016-01-21
Date First Published: 2016-01-21
Date Last Updated: 2016-01-27 23:50 UTC
Document Revision: 41

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis