CVE-2016-1984

Critical

Published: 22/01/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before January 20, 2016, has a hardcoded password for the 1MB@tMaN account. This makes it easier for remote attackers to gain access via an SSH or HTTP session.

Risk Assessment

This vulnerability increases the risk of unauthorized access to devices, potentially leading to serious security breaches within the organization.

Recommendation

It is recommended to update devices to the latest software version to remove the hardcoded password and implement strong password policies.

Original NVD description (English source)

The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2016-01-20 has a hardcoded password for the 1MB@tMaN account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2015-8362.