CVE-2025-54303
BaseFortify
Publication date: 2025-12-04
Last updated on: 2025-12-16
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| thermofisher | torrent_suite_software | 5.18.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1392 | The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Thermo Fisher Torrent Suite Django application version 5.18.1 having weak default credentials. Specifically, the ionadmin user account uses a default password 'ionadmin' stored as fixtures for the Django ORM API. Although the user guide recommends changing these default credentials, there is no enforced password change policy for default administrative accounts. As a result, many deployments may still use these default credentials, allowing attackers to authenticate with administrative privileges.
How can this vulnerability impact me? :
If the default credentials are not changed, an attacker can easily authenticate as an administrator using the ionadmin account. This grants them administrative privileges, potentially allowing unauthorized access, control, and manipulation of the application and its data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to authenticate to the Thermo Fisher Torrent Suite Django application using the default credentials: username 'ionadmin' and password 'ionadmin'. Checking for the presence of the ionadmin user account with default password on deployments is key. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include changing the default credentials for the ionadmin user account to a strong, unique password. Since the application does not enforce a password change policy for default administrative accounts, manual password updates are necessary to prevent unauthorized administrative access.