CVE-2021-47744 | THREATINT

Description

Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the static 'Chameleon' password to gain remote root access via Telnet or SSH on affected devices.

PUBLISHED Reserved 2025-12-31 | Published 2025-12-31 | Updated 2026-01-02 | Assigner VulnCheck

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Use of Hard-coded Credentials

Product status

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.exploit-db.com/exploits/50407 (ExploitDB-50407) exploit

www.cypress.bc.ca (Cypress Solutions Official Homepage) product

www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5686.php (Zero Science Lab Disclosure (ZSL-2021-5686)) third-party-advisory

www.vulncheck.com/...-one-hard-coded-credentials-remote-root (VulnCheck Advisory: Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root) third-party-advisory

cve.org (CVE-2021-47744)

nvd.nist.gov (CVE-2021-47744)

Download JSON