cbcvebase.
CVE-2016-6531
published 2016-09-24

CVE-2016-6531: Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveraging access to…

PriorityP258critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.49%
82.6th percentile
Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveraging access to intranet TCP port 3306. NOTE: the vendor disputes this issue, stating that the "vulnerability note ... is factually false ... there is indeed a default blank password, but it can be changed ... We recommend that users change it, each customer receives direction.

Affected

1 ranges
VendorProductVersion rangeFixed in
opendentalopendental<= 16.1—

Detection & IOCsextracted from sources · hover to see the quote

port3306↗
  • →Detect unauthenticated or blank-password MySQL root login attempts on TCP port 3306 from non-local hosts, which may indicate exploitation of the Open Dental default blank MySQL root credential. ↗
  • →Monitor for MySQL connections to port 3306 using the 'root' account with an empty password originating from intranet hosts, as this is the attack vector for CVE-2016-6531. ↗
  • →Inspect the Open Dental 'userod' MySQL table for password hashes stored as base64-encoded MD5 without salt, indicating credential exposure risk compounding the default-credential issue. ↗
  • ·The vendor disputed the 'hardcoded' characterization, clarifying it is a default blank password that can be changed; however the security risk of unauthenticated remote MySQL root access remains valid for unpatched/default installs. ↗
  • ·Open Dental version 18.4 introduced a prompt to set a MySQL username and password during installation, partially mitigating this issue for newer installs. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.