CVE-2018-9161
📋 TL;DR
CVE-2018-9161 is a hardcoded credential vulnerability in PrismaWEB software that exposes the default 'prisma' password in a JavaScript file. This allows remote attackers to gain unauthorized access to affected systems. Organizations using Prisma Industriale Checkweigher PrismaWEB version 1.21 are affected.
💻 Affected Systems
- Prisma Industriale Checkweigher PrismaWEB
📦 What is this software?
Checkweigher Prismaweb by Prismaindustriale
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to manipulate industrial weighing systems, disrupt production lines, or use the system as an entry point to broader industrial networks.
Likely Case
Unauthorized access to the PrismaWEB interface allowing configuration changes, data manipulation, or system disruption.
If Mitigated
Limited impact if systems are isolated from untrusted networks and access controls are properly implemented.
🎯 Exploit Status
Exploitation requires only reading the JavaScript file and using the discovered credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Contact Prisma Industriale for updated software version
2. Remove or modify the user/scripts/login_par.js file
3. Change default credentials immediately
🔧 Temporary Workarounds
Remove Exposed Credentials File
allDelete or rename the vulnerable JavaScript file containing hardcoded credentials
rm /path/to/user/scripts/login_par.js
mv /path/to/user/scripts/login_par.js /path/to/user/scripts/login_par.js.bak
Change Default Credentials
allImmediately change the default 'prisma' password to a strong, unique password
🧯 If You Can't Patch
- Network segmentation: Isolate PrismaWEB systems from untrusted networks and internet access
- Implement strict access controls: Restrict network access to only authorized IP addresses and users
🔍 How to Verify
Check if Vulnerable:
Check if file user/scripts/login_par.js exists and contains the hardcoded 'prisma' passwordCheck Version:
Check PrismaWEB interface or documentation for version informationVerify Fix Applied:
Verify the login_par.js file no longer exists or contains hardcoded credentials, and test authentication with old credentials fails📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful logins with 'prisma' username
- Unauthorized access to user/scripts/login_par.js file
Network Indicators:
- Unauthorized access to PrismaWEB web interface
- Traffic to login_par.js file from unexpected sources
SIEM Query:
source="prismaweb" AND (event="login" AND user="prisma") OR (url="*/user/scripts/login_par.js")