{"id":"CVE-2025-34034","state":"PUBLISHED","title":"5VTechnologies Blue Angel Software Suite Hardcoded Credentials","description":"A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known default and hardcoded user accounts that are not disclosed in public documentation. These accounts allow unauthenticated or low-privilege attackers to gain administrative access to the device’s web interface. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-26 UTC.","publishedAt":"2025-06-24T00:59:58.229Z","updatedAt":"2026-04-07T14:09:09.400Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["5VTechnologies Blue Angel Software Suite"],"affected":[{"vendor":"5VTechnologies","product":"Blue Angel Software Suite","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"semver"}],"modules":["Web Management Interface (/cgi-bin/webctrl.cgi)"]}],"references":["https://www.exploit-db.com/exploits/46792","https://vulncheck.com/advisories/5vtechnologies-blue-angel-hardcoded-credentials"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/34xxx/CVE-2025-34034.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-34034","state":"PUBLISHED","datePublished":"2025-06-24T00:59:58.229Z","dateUpdated":"2026-04-07T14:09:09.400Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-04-15T19:15:22.546Z"},"containers":{"cna":{"title":"5VTechnologies Blue Angel Software Suite Hardcoded Credentials","descriptions":[{"lang":"en","value":"A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known default and hardcoded user accounts that are not disclosed in public documentation. These accounts allow unauthenticated or low-privilege attackers to gain administrative access to the device’s web interface. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-26 UTC."}],"affected":[{"vendor":"5VTechnologies","product":"Blue Angel Software Suite","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","versionType":"semver"}],"modules":["Web Management Interface (/cgi-bin/webctrl.cgi)"]}],"references":[{"url":"https://www.exploit-db.com/exploits/46792","tags":["third-party-advisory","exploit"]},{"url":"https://vulncheck.com/advisories/5vtechnologies-blue-angel-hardcoded-credentials","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798 Use of Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-04-07T14:09:09.400Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:5vtechnologies:blue_angel_software_suite:*:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Paolo Serracino"},{"lang":"en","type":"finder","value":"Pietro Minniti"},{"lang":"en","type":"finder","value":"Damiano Proietti"}],"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"source":{"discovery":"UNKNOWN"},"tags":["x_known-exploited-vulnerability"],"x_generator":{"engine":"vulncheck"},"datePublic":"2019-05-03T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.exploit-db.com/exploits/46792","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-24T21:54:59.869800Z","id":"CVE-2025-34034","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-24T21:55:20.379Z"}}]}}}