CVE-2021-28912
Published: 09 September 2021
Summary
CVE-2021-28912 is a high-severity Weak Password Requirements (CWE-521) vulnerability in Bab-Technologie Eibport Firmware. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 23.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-15565
Vulnerability details
BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
IA policy establishes password requirements, directly addressing weak password requirements.
Ensuring authenticators have sufficient strength of mechanism for intended use addresses weak password requirements.
Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.
Dedicated security resources support deployment of strong authentication systems and enforcement of robust password policies.
User documentation on maintaining security includes password requirements, directly mitigating weak password policies.
Enables users to notice when hard-coded credentials have been exploited for unauthorized access.
Security training explicitly warns against hard-coded credentials, lowering their use in systems.
Configuration settings can define and enforce strong password requirements to avoid weak policies.