« Volver al listado

CVE-2020-11543

Estado: ModificadaCrítica (9.8)—

OpsRamp Gateway anterior a la versión 7.0.0 tiene una cuenta de puerta trasera vadmin con la contraseña 9vt@f3Vt que permite el acceso SSH raíz al servidor. Este problema ha sido resuelto en la versión 7.0.0 del firmware de OpsRamp Gateway donde las cuentas de un administrador y un usuario del sistema son las únicas cuentas de usuario disponibles para el dispositivo de la pasarela

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Opsramp — Gateway

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-11543",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-08T00:15:11.207",
  "references": [
    {
      "url": "https://docs.opsramp.com/about/release-notes/summer-2020-update/#simplified-gateway-appliance-accounts",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.criticalstart.com/hard-coded-administrator-password-discovered-in-opsramp/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://docs.opsramp.com/about/release-notes/summer-2020-update/#simplified-gateway-appliance-accounts",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.criticalstart.com/hard-coded-administrator-password-discovered-in-opsramp/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server. This issue has been resolved in OpsRamp Gateway firmware version 7.0.0 where an administrator and a system user accounts are the only available user accounts for the gateway appliance."
    },
    {
      "lang": "es",
      "value": "OpsRamp Gateway anterior a la versión 7.0.0 tiene una cuenta de puerta trasera vadmin con la contraseña 9vt@f3Vt que permite el acceso SSH raíz al servidor. Este problema ha sido resuelto en la versión 7.0.0 del firmware de OpsRamp Gateway donde las cuentas de un administrador y un usuario del sistema son las únicas cuentas de usuario disponibles para el dispositivo de la pasarela"
    }
  ],
  "lastModified": "2026-06-17T02:50:22.513",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opsramp:gateway:3.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BFF495A-5A43-4F74-9396-0164135A8131"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}