CVE-2018-9161

What it actually does

The application exposes a hardcoded credential for the prismaweb account directly in a client-side JavaScript file that any unauthenticated remote user can retrieve.

Why it matters to the business

Attackers can obtain full administrative access to industrial checkweigher systems, allowing unauthorized control or disruption of production weighing processes with high likelihood of exploitation.

How an attack unfolds

An attacker requests the publicly accessible user/scripts/login_par.js file, extracts the embedded prisma password, and authenticates to the PrismaWEB interface; weaponized exploits have been available since publication.

How to fix it

Remove the hardcoded credential from all client-side scripts, enforce unique per-installation passwords, restrict direct access to static script files, and apply any vendor patches that eliminate the exposure.

How to confirm the fix worked

Inspect the contents of user/scripts/login_par.js (or equivalent static files) for embedded credentials, attempt unauthenticated retrieval of the file, and verify that login requires per-instance credentials rather than the known default.

Typical attack path

1. Locate the PrismaWEB web interface via network scanning or OSINT
2. Fetch /user/scripts/login_par.js without authentication
3. Parse the JavaScript to obtain the hardcoded prisma password
4. Authenticate to the application using the prismaweb account
5. Perform unauthorized configuration changes or data exfiltration

How to detect it

Review web server access logs for GET requests to login_par.js or similar credential-containing scripts from unexpected sources; search application logs for authentication attempts using the known prismaweb account.

• GET /user/scripts/login_par.js
• prismaweb
• login_par.js

What your security team should do

• Immediately block unauthenticated access to static JavaScript resources serving login data
• Rotate all credentials used by the prismaweb account and audit recent logins
• Scan the environment for any other instances of hardcoded credentials in web assets
• Monitor EPSS score and exploit availability for prioritization of remaining instances