Cloudanix VulnDB

CVE-2014-9614

Critical · 9.8

CVSS

9.8

EPSS

68.7%

Published

Feb 19, 2020

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

A widely used web filtering product shipped with an easy-to-guess default password that let anyone on the internet take over its management console.

Weaponized
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Full Compromise
Component
Application
Class
Credential Exposure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Remote attackers can authenticate to the Web Panel using the hardcoded default password 'branding' on the 'branding' account without any credentials being supplied by the product.

Why it matters to the business

Attackers obtain complete administrative access to the web filtering platform, allowing them to disable protections, alter policies, or exfiltrate configuration and user data across the organization.

How an attack unfolds

An attacker locates the exposed Web Panel, issues an unauthenticated request to /webadmin/, and supplies the default 'branding' account credentials to obtain a valid session and full administrative control.

How to fix it

Upgrade all Netsweeper installations to version 4.0.5 or later and immediately replace the default branding account password with a strong, unique credential.

How to confirm the fix worked

Confirm the installed version is at least 4.0.5, verify that the branding account no longer accepts the default password, and review authentication logs for any prior use of the default credentials.

Typical attack path

  1. Scan for or discover Netsweeper Web Panel instances reachable on the network
  2. Issue HTTP request to the /webadmin/ endpoint
  3. Authenticate using the default branding account and password
  4. Perform administrative actions such as policy changes or data extraction

How to detect it

Search web server and application logs for successful or failed authentication attempts using the 'branding' username, repeated requests to the /webadmin/ path, and any administrative sessions originating from unexpected source IPs.

  • /webadmin/
  • username=branding
  • password=branding
  • brandaing account login

What your security team should do

  • Immediately upgrade to Netsweeper 4.0.5 or newer
  • Change or disable the branding account and enforce strong unique passwords for all accounts
  • Restrict network access to the Web Panel to only authorized management hosts
  • Monitor authentication logs for the branding account and /webadmin/ endpoint access

The record

The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities