Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability involves a default password in the web client of Axxon One, which could allow unauthorized remote access to newly installed systems. The main concern is confirming whether this specific product is in use and exposed.
- Default passwords allow unauthorized remote access.
- Confirm if this product is deployed and exposed.
- Prioritize verifying its relevance to our environment.
Attack Path
How an attacker could exploit the issue
An attacker can access a newly installed system over the network and log in as the administrator without needing any credentials or user interaction. This is possible because the web client on the affected system does not require the default password to be changed upon first use, allowing an unauthenticated remote user to gain administrative access.
- Remote, unauthenticated access to the web client.
- Logging into the web client with default credentials.
- Unauthorized administrative control of the system.
Live Threat
Current exploitation, exposure, and threat context
A remote, unauthenticated attacker could gain administrative access to a newly installed system via its web client. This occurs when the default administrator password is not changed upon initial setup.
- Administrator credentials.
- Default password not changed.
- Unauthorized system control.
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams responsible for the Axxon One product and its underlying operating systems (Windows/Linux) should prioritize addressing this vulnerability. The first practical step is to identify all deployed instances of the affected web client, confirm their external reachability, and determine the business criticality of each instance to establish a remediation priority.
- Product and infrastructure teams own remediation.
- Verify external reachability and business criticality first.
- Plan immediate configuration review and password reset.
