漏洞描述
Room Alert 温度及环境监视器 web 页面使用 Basic基本身份认证进行认证，可以使用空密码进行绕过登录，成功获取监视器的管理权限，可对设备配置进行篡改。
Room Alert 管理页面默认口令
PoC代码
暂无相关漏洞推荐
- alertmanager-unauth: Alertmanager 未授权访问
- POC CVE-2011-5107: Alert Before Your Post <= 0.1.1 - Cross-Site Scripting
- POC CVE-2018-12054: Schools Alert Management Script - Arbitrary File Read
- POC CVE-2020-26214: Alerta < 8.1.0 - Authentication Bypass
- POC CVE-2024-46506: NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution
- POC CVE-2024-48766: NetAlert X - Arbitary File Read
- POC azure-db-mysql-delete-unalerted: Azure MySQL Database Delete Alert Not Configured
- POC azure-delete-lb-alert-unconfigured: Azure Delete Load Balancer Alert Not Configured
- POC azure-key-vault-delete-unalerted: Azure Key Vault Delete Alert Not Configured
- POC azure-keyvault-update-unalerted: Azure Key Vault Update Alert Not Configured
- POC azure-lb-create-update-missing: Azure Load Balancer Create or Update Alert Not Configured
- POC azure-mysql-db-update-unalerted: Azure MySQL Database Create/Update Alert Not Configured
- POC azure-nsg-create-update-unalerted: Azure Network Security Group Create/Update Alert Not Configured