Use of Hard-coded Credentials in DMS+

Executive Summary

DMS+ (Non-Mobile) by Rich Source contains a hard-coded API key that allows unauthenticated remote attackers to gain full control over all installed DMS+ devices. This means attackers can remotely execute commands or access sensitive data without needing valid credentials.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for exposed DMS+ devices using the hard-coded API key. Scan your network for devices running DMS+ and verify if they respond to API requests using the fixed credentials. Use network scanning tools like nmap to identify DMS+ services and test API endpoints for unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to take complete control of affected DMS+ devices. This could lead to unauthorized access to systems, data breaches, disruption of services, or further compromise of connected networks. Users relying on these devices for critical operations face significant risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security, such as GDPR (data confidentiality) and HIPAA (protected health information). Organizations using affected DMS+ devices may face legal penalties, fines, or mandatory breach notifications due to unauthorized access risks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately rotate or remove the hard-coded API key from all DMS+ devices. Update to a patched version if available. Restrict network access to DMS+ devices by implementing firewalls or network segmentation. Monitor for unauthorized API access attempts and audit device configurations.

Useful 0 Not Useful 0