CVE-2023-36651

Name of the Vulnerable Software and Affected Versions ProLion CryptoSpike version 3.0.15P2

Description The issue concerns hidden and hard-coded credentials in the software, allowing remote attackers to login to web management as a super-admin. This access enables the consumption of the most privileged REST API endpoints via these credentials.

Recommendations For ProLion CryptoSpike version 3.0.15P2, consider changing the hard-coded credentials to unique, secure credentials to prevent unauthorized access. As a temporary workaround, restrict access to the web management interface and the most privileged REST API endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.