Hard-coded credentials in Cypress Solutions CTM-200 and CTM-ONE gateways allow unauthenticated remote attackers to obtain full root-level control of the device.

The devices contain a static, hard-coded password, specifically identified as "Chameleon", within the Linux distribution image. This vulnerability allows any unauthenticated attacker with network access to the management interface to authenticate as the root user.

The ability for an unauthenticated attacker to gain remote root access presents a critical risk to business operations, as these devices are often utilized in industrial SCADA and fleet management environments. A compromise could lead to full loss of confidentiality, integrity, and availability of the gateway, potentially allowing attackers to pivot into internal networks or disrupt critical infrastructure. Given the CVSS score of 7.5, this vulnerability is categorized as High, reflecting the severe impact of unauthorized administrative access.

Immediate Action: Identify all deployed CTM-200 and CTM-ONE units and immediately restrict access to Telnet and SSH services to trusted management IP addresses only, or disable these services entirely if not required. Contact Cypress Solutions support to obtain firmware updates that remove the hard-coded credentials.

Proactive Monitoring: Review firewall and access logs for unusual inbound traffic on ports 22 (SSH) and 23 (Telnet), particularly from unauthorized or external IP ranges. Monitor system logs for successful logins originating from unknown or suspicious sources.

Compensating Controls: Deploy a network-level firewall or an intrusion prevention system (IPS) to block all unauthorized access to the management interfaces of these devices. Ensure the devices are segmented from the public internet and critical production subnets.

Public Exploit Available: Yes, a public exploit exists, as documented in the Exploit-DB entry (EDB-ID 50407) which provides a functional script for remote root access.

This vulnerability represents a significant security failure due to the presence of hard-coded credentials, which are trivial to exploit. Organizations utilizing these industrial gateways must prioritize isolating these devices from the network immediately. Applying vendor-supplied patches is the only definitive way to remove the hard-coded account, and this should be scheduled as a priority task to prevent potential remote system compromise.