By default, Tridium NiagaraAX installs with a default password. The admin account has no password, and this is publicly known and documented. This allows attackers to trivially access the program or system and gain privileged access.
Classification
Location:
Remote / Network Access
Attack Type:
Authentication Management,
Misconfiguration
Impact:
Loss of Integrity
Solution:
Change Default Setting
Exploit:
Exploit Public
Disclosure:
Vendor Verified
OSVDB:
SCADA
Solution
Immediately after installation, change all default installed accounts to use a unique and secure password. When possible, change default account names to custom names as well.
