CVE-2020-35338

published 2020-12-14

CVE-2020-35338: The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password…

Priority P2 74 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password of "pokon."

Affected

1 ranges

Vendor	Product	Version range	Fixed in
mobileviewpoint	wireless_multiplex_terminal_playout_server	<= 20.2.8	—

Detection & IOCs extracted from sources · hover to see the quote

other Basic OnBva29u

path /server/

other pokon↗

• → Send a GET request to /server/ with the Authorization header 'Basic OnBva29u' (Base64 of ':pokon'). A 200 response containing the string 'WMT Server' confirms successful authentication with default credentials.
• → The response body keyword 'WMT Server' in combination with HTTP 200 status is a reliable indicator that the default credential (empty username / password 'pokon') is accepted by the Web Administrative Interface.

• · The default credential applies to Mobile Viewpoint WMT Playout Server version 20.2.8 and earlier only. Versions beyond 20.2.8 are not confirmed to carry this default password. ↗
• · The Base64 value 'OnBva29u' decodes to ':pokon', indicating an empty username field. Scanners must send the Authorization header exactly as shown; a non-empty username will not match the default account.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-798