Default Credentials in Logsign SIEM

Executive Summary

This vulnerability involves the use of default credentials in Logsign SIEM software by Innotim Software. It allows attackers to exploit common or default usernames and passwords, potentially gaining unauthorized access to the system.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by scanning for default credentials on Logsign SIEM systems. Check for accounts using default usernames and passwords, particularly in versions 6.4.101 to 6.4.117. Use network scanners like Nmap with default credential checks or manual inspection of login pages.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full control over the Logsign SIEM system, leading to data breaches, unauthorized access to sensitive information, or disruption of services. The high CVSS score indicates severe potential impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or breaches. It may result in legal penalties, loss of trust, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Logsign SIEM to version 6.4.117 or later to address the default credentials issue. Disable or remove any default accounts and enforce strong password policies. Monitor for unauthorized access attempts and audit user accounts regularly.

Useful 0 Not Useful 0