CVE-2017-12577

Name of the Vulnerable Software and Affected Versions: PLANEX CS-QR20 version 1.30

Description: A security issue was found where a hardcoded account and password, admin and password, are used in the Android application. This allows attackers to utilize a hidden API URL "/goform/SystemCommand" to execute any command with root permission.

Recommendations: For PLANEX CS-QR20 version 1.30, consider changing the default admin password to a strong and unique one, and restrict access to the "/goform/SystemCommand" API endpoint to prevent unauthorized command execution. As a temporary workaround, consider disabling the use of the hardcoded admin account until a patch is available.