Vulnerability Note VU#992624
Harman AMX multimedia devices contain hard-coded credentials
Original Release date: 21 Jan 2016 | Last revised: 27 Jan 2016

Overview
Multiple models of Harman AMX multimedia devices contain a hard-coded debug account.

Description
CWE-798: Use of Hard-coded Credentials – CVE-2015-8362
According to the researchers’ blog post, several models of Harman AMX multimedia devices contain a hard-coded "backdoor" account with administrative permissions. Further details are available in the researchers’ vulnerability advisory. AMX firmware release notes indicate this was a debugging account left in the released firmware.

The following software versions of the AMX NX-1200 have been reported to be vulnerable:

v1.2.322
v1.3.100

Affected devices include but are not limited to:

AMX NX-1200
AMX DGX16-ENC (Digital Media Switchers)
AMX DGX32-ENC-A (Digital Media Switchers)
AMX DGX64-ENC (Digital Media Switchers)
AMX DGX8-ENC (Digital Media Switchers)
AMX DVX-2100HD (All-In-One Presentation Switchers)
AMX DVX-2210HD (All-In-One Presentation Switchers)
AMX DVX-2250HD (All-In-One Presentation Switchers)
AMX DVX-2255HD (All-In-One Presentation Switchers)
AMX DVX-3250HD (All-In-One Presentation Switchers)
AMX DVX-3255HD (All-In-One Presentation Switchers)
AMX DVX-3256HD (All-In-One Presentation Switchers)
AMX ENOVADGX64-ENC (Digital Media Switchers)
AMX MCP-106 (ControlPads)
AMX MCP-108 (ControlPads)
AMX NI-2000 (Central Controllers)
AMX NI-2100 (Central Controllers)
AMX NI-3000 (Central Controllers)
AMX NI-3100 (Central Controllers)
AMX NI-3101-SIG (Central Controllers)
AMX NI-4000 (Central Controllers)
AMX NI-4100 (Central Controllers)
AMX NI-700 (Central Controllers)
AMX NI-900 (Central Controllers)
AMX NX-1200 (Central Controllers)
AMX NX-2200 (Central Controllers)
AMX NX-3200 (Central Controllers)
AMX NX-4200 (Central Controllers)
AMX NXC-ME260-64 (Central Controllers)
AMX NXC-MPE (Central Controllers)
AMX NetLinx NX Integrated Controller (Media)

Impact
An attacker with knowledge of the account credentials can obtain administrative access on the device.

Solution
Apply an update
AMX has released an update for some devices. Affected users are encouraged to contact Harman’s support line for more information on obtaining the update.
Restrict network access
Use a firewall or similar technology to restrict access to trusted hosts, networks, and services. Consider operating AMX devices on a separate network segment or VLAN. AMX devices support SSH, HTTP, possibly HTTPS, ICSP, and possibly other services.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedHarmanAffected-21 Jan 2016If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal
7.8
E:POC/RL:OF/RC:C

Environmental
5.9
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

http://blog.sec-consult.com/2016/01/deliberately-hidden-backdoor-account-in.html
http://www.amx.com/techcenter/NXSecurityBrief/
http://www.amx.com/techcenter/firmware.asp?Category=Hot%20Fix%20Files
http://seclists.org/fulldisclosure/2016/Jan/63
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20160121-0_AMX_Deliberately_hidden_backdoor_account_v10.txt
http://www.amx.com/assets/whitePapers/AMX.AVIT.Administrators.Guide.pdf

Credit

Thanks to Johannes Greil of SEC Consult for reporting this vulnerability.
This document was written by Garret Wassermann.

Other Information

CVE IDs:
CVE-2015-8362

Date Public:
21 Jan 2016

Date First Published:
21 Jan 2016

Date Last Updated:
27 Jan 2016

Document Revision:
39

FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.

Leave a Reply