Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-30300 State: PUBLISHED Published: 2023-02-16T18:05:25.362Z Last Updated: 2024-10-22T20:50:34.226Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-23 Description: A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-136
CVE ID: CVE-2022-30301 State: PUBLISHED Published: 2022-07-18T16:35:46 Last Updated: 2024-10-25T13:31:12.470Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiAP-U Problem Types: Execute unauthorized code or commands Description: A path traversal vulnerability [CWE-22] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin user to delete and access unauthorized files and data via specifically crafted CLI commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-109
CVE ID: CVE-2022-30302 State: PUBLISHED Published: 2022-07-18T16:40:27 Last Updated: 2024-10-22T20:55:58.209Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiDeceptor Problem Types: Information disclosure Description: Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 may allow a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
cially crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-213
CVE ID: CVE-2022-30303 State: PUBLISHED Published: 2023-02-16T18:05:22.629Z Last Updated: 2024-10-23T14:50:25.965Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-78 Description: An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-163
CVE ID: CVE-2022-30304 State: PUBLISHED Published: 2023-02-16T18:06:27.170Z Last Updated: 2024-10-22T20:49:47.941Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiAnalyzer Problem Types: CWE-79 Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
logview in FortiAnalyzer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-166
CVE ID: CVE-2022-30305 State: PUBLISHED Published: 2022-12-06T16:00:54.500Z Last Updated: 2024-10-22T20:51:37.602Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSandbox, FortiDeceptor Problem Types: CWE-778 Description: An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 and 3.0.0 through 3.0.2 may allow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no limit on the n
llow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no limit on the number of failed authentication attempts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-170
CVE ID: CVE-2022-30306 State: PUBLISHED Published: 2023-02-16T18:06:14.226Z Last Updated: 2024-10-23T14:47:11.505Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability [CWE-121] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-167
CVE ID: CVE-2022-30307 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-22T20:53:14.268Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L/E:X/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Improper access control Description: A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-228
CVE ID: CVE-2022-30308 State: PUBLISHED Published: 2022-06-13T13:45:20.015729Z Last Updated: 2024-09-16T22:40:02.831Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Festo Products: Controller CECC-X-M1 (4407603), Controller CECC-X-M1 (8124922), Controller CECC-X-M1-MV (4407605), Controller CECC-X-M1-MV (8124923), Controller CECC-X-M1-MV-S1 (4407606), Controller CECC-X-M1-MV-S1 (8124924), Controller CECC-X-M1-YS-L1 (8082793), Controller CECC-X-M1-YS-L2 (8082794), Controller CECC-X-M1-Y-YJKP (4803891), Servo Press Kit YJKP (8077950), Servo Press Kit YJKP- (8058596) Problem Types: CWE-863, CWE-78 Description: In Festo Controller CECC-X-M1 product family in m
Press Kit YJKP- (8058596) Problem Types: CWE-863, CWE-78 Description: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2022-020/
CVE ID: CVE-2022-30309 State: PUBLISHED Published: 2022-06-13T13:45:21.634733Z Last Updated: 2024-09-16T22:15:41.158Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Festo Products: Controller CECC-X-M1 (4407603), Controller CECC-X-M1 (8124922), Controller CECC-X-M1-MV (4407605), Controller CECC-X-M1-MV (8124923), Controller CECC-X-M1-MV-S1 (4407606), Controller CECC-X-M1-MV-S1 (8124924), Controller CECC-X-M1-YS-L1 (8082793), Controller CECC-X-M1-YS-L2 (8082794), Controller CECC-X-M1-Y-YJKP (4803891), Servo Press Kit YJKP (8077950), Servo Press Kit YJKP- (8058596) Problem Types: CWE-863, CWE-78 Description: In Festo Controller CECC-X-M1 product family in m
Press Kit YJKP- (8058596) Problem Types: CWE-863, CWE-78 Description: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2022-020/
CVE ID: CVE-2022-30310 State: PUBLISHED Published: 2022-06-13T13:45:23.105104Z Last Updated: 2024-11-20T15:21:04.526Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Festo Products: Controller CECC-X-M1 (4407603), Controller CECC-X-M1 (8124922), Controller CECC-X-M1-MV (4407605), Controller CECC-X-M1-MV (8124923), Controller CECC-X-M1-MV-S1 (4407606), Controller CECC-X-M1-MV-S1 (8124924), Controller CECC-X-M1-YS-L1 (8082793), Controller CECC-X-M1-YS-L2 (8082794), Controller CECC-X-M1-Y-YJKP (4803891), Servo Press Kit YJKP (8077950), Servo Press Kit YJKP- (8058596) Problem Types: CWE-863, CWE-78 Description: In Festo Controller CECC-X-M1 product family in m
Press Kit YJKP- (8058596) Problem Types: CWE-863, CWE-78 Description: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-020/
CVE ID: CVE-2022-30311 State: PUBLISHED Published: 2022-06-13T13:45:24.763817Z Last Updated: 2024-09-16T23:41:46.855Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Festo Products: Controller CECC-X-M1 (4407603), Controller CECC-X-M1 (8124922), Controller CECC-X-M1-MV (4407605), Controller CECC-X-M1-MV (8124923), Controller CECC-X-M1-MV-S1 (4407606), Controller CECC-X-M1-MV-S1 (8124924), Controller CECC-X-M1-YS-L1 (8082793), Controller CECC-X-M1-YS-L2 (8082794), Controller CECC-X-M1-Y-YJKP (4803891), Servo Press Kit YJKP (8077950), Servo Press Kit YJKP- (8058596) Problem Types: CWE-863, CWE-78 Description: In Festo Controller CECC-X-M1 product family in m
Press Kit YJKP- (8058596) Problem Types: CWE-863, CWE-78 Description: In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2022-020/
CVE ID: CVE-2022-30312 State: PUBLISHED Published: 2022-09-07T17:54:02.000Z Last Updated: 2025-06-17T19:36:00.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Controls Inter-Controller (IC) protocol cleartext transmission of credentials issue. The affected components are characterized as: Inter-Controller (IC) protocol (57612/UDP). The potential impact is: Compromise of credentials. Several Trend Controls building automation controllers utilize the Inter-Controller (IC) protocol in for information exchange and automation purpos
ding automation controllers utilize the Inter-Controller (IC) protocol in for information exchange and automation purposes. This protocol offers authentication in the form of a 4-digit PIN in order to protect access to sensitive operations like strategy uploads and downloads as well as optional 0-30 character username and password protection for web page access protection. Both the PIN and usernames and passwords are transmitted in cleartext, allowing an attacker with passive interception capabilities to obtain these credentials. Credentials are transmitted in cleartext. An attacker who obtains Trend IC credentials can carry out sensitive engineering actions such as manipulating controller s
attacker who obtains Trend IC credentials can carry out sensitive engineering actions such as manipulating controller strategy or configuration settings. If the credentials in question are (re)used for other applications, their compromise could potentially facilitate lateral movement. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-08
CVE ID: CVE-2022-30313 State: PUBLISHED Published: 2022-07-28T15:41:25 Last Updated: 2024-11-20T16:15:51.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0051, there is a Honeywell Experion PKS Safety Manager multiple proprietary protocols with unauthenticated functionality issue. The affected components are characterized as: Honeywell Experion TCP (51000/TCP), Safety Builder (51010/TCP). The potential impact is: Manipulate controller state, Manipulate controller configuration, Manipulate controller logic, Manipulate controller files, Manipulate I
oller state, Manipulate controller configuration, Manipulate controller logic, Manipulate controller files, Manipulate IO. The Honeywell Experion PKS Distributed Control System (DCS) Safety Manager utilizes several proprietary protocols for a wide variety of functionality, including process data acquisition, controller steering and configuration management. These protocols include: Experion TCP (51000/TCP) and Safety Builder (51010/TCP). None of these protocols have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality. There is no authentication functionality on the protocols in question. An attac
oke (a subset of) desired functionality. There is no authentication functionality on the protocols in question. An attacker capable of invoking the protocols' functionalities could achieve a wide range of adverse impacts, including (but not limited to), the following: for Experion TCP (51000/TCP): Issue IO manipulation commands, Issue file read/write commands; and for Safety Builder (51010/TCP): Issue controller start/stop commands, Issue logic download/upload commands, Issue file read commands, Issue system time change commands. A mitigating factor with regards to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right pos
t not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right position. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
CVE ID: CVE-2022-30314 State: PUBLISHED Published: 2022-07-28T15:41:20 Last Updated: 2024-08-03T06:48:36.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded credentials issue. The affected components are characterized as: POLO bootloader. The potential impact is: Manipulate firmware. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 serial interface for firmware management purposes. When booting, the Safety Manager exposes the Enea POLO bootloader via this interface. Access to the boot configuration is co
booting, the Safety Manager exposes the Enea POLO bootloader via this interface. Access to the boot configuration is controlled by means of credentials hardcoded in the Safety Manager firmware. The credentials for the bootloader are hardcoded in the firmware. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize these credentials to control the boot process and manipulate the unauthenticated firmware image (see FSCT-2022-0054). Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
CVE ID: CVE-2022-30315 State: PUBLISHED Published: 2022-07-28T15:41:18 Last Updated: 2024-08-03T06:48:34.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is a Honeywell Experion PKS Safety Manager insufficient logic security controls issue. The affected components are characterized as: Honeywell FSC runtime (FSC-CPU, QPP), Honeywell Safety Builder. The potential impact is: Remote Code Execution, Denial of Service. The Honeywell Experion PKS Safety Manager family of safety controllers utilize the unauthenticated Safety Buil
Service. The Honeywell Experion PKS Safety Manager family of safety controllers utilize the unauthenticated Safety Builder protocol (FSCT-2022-0051) for engineering purposes, including downloading projects and control logic to the controller. Control logic is downloaded to the controller on a block-by-block basis. The logic that is downloaded consists of FLD code compiled to native machine code for the CPU module (which applies to both the Safety Manager and FSC families). Since this logic does not seem to be cryptographically authenticated, it allows an attacker capable of triggering a logic download to execute arbitrary machine code on the controller's CPU module in the context of the run
f triggering a logic download to execute arbitrary machine code on the controller's CPU module in the context of the runtime. While the researchers could not verify this in detail, the researchers believe that the microprocessor underpinning the FSC and Safety Manager CPU modules is incapable of offering memory protection or privilege separation capabilities which would give an attacker full control of the CPU module. There is no authentication on control logic downloaded to the controller. Memory protection and privilege separation capabilities for the runtime are possibly lacking. The researchers confirmed the issues in question on Safety Manager R145.1 and R152.2 but suspect the issue aff
lacking. The researchers confirmed the issues in question on Safety Manager R145.1 and R152.2 but suspect the issue affects all FSC and SM controllers and associated Safety Builder versions regardless of software or firmware revision. An attacker who can communicate with a Safety Manager controller via the Safety Builder protocol can execute arbitrary code without restrictions on the CPU module, allowing for covert manipulation of control operations and implanting capabilities similar to the TRITON malware (MITRE ATT&CK software ID S1009). A mitigating factor with regards to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in th
to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right position. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
CVE ID: CVE-2022-30316 State: PUBLISHED Published: 2022-07-28T15:41:12 Last Updated: 2024-08-03T06:48:34.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthenticated firmware update issue. The affected components are characterized as: Firmware update functionality. The potential impact is: Firmware manipulation. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 communication FTA serial interface and Enea POLO bootloader for firmware management purposes. An engineering workstation runni
ication FTA serial interface and Enea POLO bootloader for firmware management purposes. An engineering workstation running the Safety Builder software communicates via serial or serial-over-ethernet link with the DCOM-232/485 interface. Firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks. Firmware images are unsigned. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize hardcoded credentials (see FSCT-2022-0052) for the POLO bootloader to control the boot process and push malicious firmware im
oded credentials (see FSCT-2022-0052) for the POLO bootloader to control the boot process and push malicious firmware images to the controller allowing for firmware manipulation, remote code execution and denial of service impacts. A mitigating factor is that in order for a firmware update to be initiated, the Safety Manager has to be rebooted which is typically done by means of physical controls on the Safety Manager itself. As such, an attacker would have to either lay dormant until a legitimate reboot occurs or possibly attempt to force a reboot through a secondary vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www
rability. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-02
CVE ID: CVE-2022-30317 State: PUBLISHED Published: 2022-08-31T15:22:02 Last Updated: 2024-08-03T06:48:35.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055, there is a Honeywell Experion LX Control Data Access (CDA) EpicMo protocol with unauthenticated functionality issue. The affected components are characterized as: Honeywell Control Data Access (CDA) EpicMo (55565/TCP). The potential impact is: Firmware manipulation, Denial of service. The Honeywell Experion LX Distributed Control System (DCS) utilizes the Control Data Access (CDA) EpicMo protocol (55565/TC
Honeywell Experion LX Distributed Control System (DCS) utilizes the Control Data Access (CDA) EpicMo protocol (55565/TCP) for device diagnostics and maintenance purposes. This protocol does not have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality. There is no authentication functionality on the protocol in question. An attacker capable of invoking the protocols' functionalities could issue firmware download commands potentially allowing for firmware manipulation and reboot devices causing denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescou
devices causing denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-07
CVE ID: CVE-2022-30318 State: PUBLISHED Published: 2022-08-31T15:39:14 Last Updated: 2024-08-03T06:48:35.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. The affected components are characterized as: SSH. The potential impact is: Remote code execution, manipulate configuration, denial of service. The Honeywell ControlEdge PLC and RTU product line exposes an SSH service on port 22/TCP. Login as root to this service is permitted and credentials for the root user are hardcoded without automatically changing them upon first co