CVE-2020-35338
📋 TL;DR
CVE-2020-35338 is a critical authentication bypass vulnerability in Mobile Viewpoint WMT Playout Server's web administrative interface. It allows attackers to gain administrative access using default credentials (username: unknown, password: 'pokon'). This affects organizations using Mobile Viewpoint WMT Playout Server version 20.2.8 and earlier.
💻 Affected Systems
- Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the playout server allowing attackers to disrupt broadcast operations, inject malicious content, or pivot to internal networks.
Likely Case
Unauthorized administrative access leading to configuration changes, service disruption, or data exfiltration.
If Mitigated
Limited impact if strong network segmentation and monitoring are in place, though authentication bypass remains possible.
🎯 Exploit Status
Simple credential-based attack requiring only web access to administrative interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 20.2.8
Vendor Advisory: https://www.mobileviewpoint.com/
Restart Required: Yes
Instructions:
1. Contact Mobile Viewpoint for updated firmware. 2. Backup current configuration. 3. Apply firmware update. 4. Change all default credentials. 5. Restart system.
🔧 Temporary Workarounds
Change Default Password
allImmediately change the default 'pokon' password to a strong, unique password.
Access web interface > Administration > Change Password
Network Segmentation
linuxRestrict access to administrative interface using firewall rules.
iptables -A INPUT -p tcp --dport [admin_port] -s [trusted_ips] -j ACCEPT
iptables -A INPUT -p tcp --dport [admin_port] -j DROP
🧯 If You Can't Patch
- Immediately change all default credentials to strong, unique passwords
- Implement strict network access controls to limit administrative interface access to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Attempt to login to web administrative interface using default credentials (password: 'pokon'). If successful, system is vulnerable.Check Version:
Check web interface login page or system information page for version numberVerify Fix Applied:
Verify default credentials no longer work and check system version is above 20.2.8.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful login with default credentials
- Multiple login attempts from unusual IP addresses
Network Indicators:
- HTTP POST requests to login endpoint with 'pokon' password
- Unusual administrative access from non-standard IPs
SIEM Query:
source="web_logs" AND (password="pokon" OR failed_login>5)