Vulnerability Note VU#544527
OpenELEC and RasPlex have a hard-coded SSH root password
Original Release date: 02 Feb 2016 | Last revised: 02 Feb 2016

Overview
OpenELEC and derivatives utilize a hard-coded default root password, and enable SSH root access by default.

Description
CWE-259: Use of Hard-coded Password
OpenELEC has a hard-coded root password. The root partition is by default read-only, preventing a user from changing the password once installed; furthermore, SSH access is enabled by default.

RasPlex is based on OpenELEC and therefore inherits this same problem.

According to RasPlex, "The root filesystem is read only (squashfs). This prevents the ability to change the root password, but also prevents an attacker from modifying the filesystem."

Impact
A remote attacker may gain root access to the device.

Solution
The CERT/CC is currently unaware of a full solution to this issue. Affected users may consider the following mitigations:

Disable SSH password access

Disable the use of password access to SSH, and enable SSH keys instead.

RasPlex notes that "users can simply disable SSH via the dialog if they are worried about being compromised."

Build with a different password

Developers may build their own distribution of OpenELEC or RasPlex from source and modify the root password at build time. Users should be aware however that this password is still hard-coded and may leave a user vulnerable to further attack; future password changes would require another rebuild and deployment.

Restrict network access

Use a firewall or similar technology to restrict access to trusted hosts, networks, and services.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedOpenELECAffected-29 Jan 2016
RasPlexAffected-29 Jan 2016If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal
8.5
E:POC/RL:U/RC:UR

Environmental
2.1
CDP:ND/TD:L/CR:ND/IR:ND/AR:ND

References

http://wiki.openelec.tv/index.php?title=OpenELEC_FAQ#SSH_Password_change
http://wiki.openelec.tv/index.php?title=Config_connect_ssh_wo_password
http://wiki.openelec.tv/index.php?title=Compile_from_source
https://github.com/RasPlex/RasPlex/issues/453

Credit

Thanks to Aidan Samuel for reporting this vulnerability.
This document was written by Garret Wassermann.

Other Information

CVE IDs:
Unknown

Date Public:
02 Feb 2016

Date First Published:
02 Feb 2016

Date Last Updated:
02 Feb 2016

Document Revision:
24

FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.