CVE-2021-37555
📋 TL;DR
CVE-2021-37555 allows attackers to gain root shell access on TX9 Automatic Food Dispenser devices via telnet using default credentials. This enables complete device compromise and filesystem access. Organizations using these food dispensers in commercial or institutional settings are affected.
💻 Affected Systems
- TX9 Automatic Food Dispenser
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing firmware modification, data theft, or using device as pivot point into internal networks
Likely Case
Unauthorized access to device configuration, potential data exfiltration, and disruption of food dispensing operations
If Mitigated
Limited to isolated network segments with no sensitive data access
🎯 Exploit Status
Exploitation requires telnet access and uses known default credentials
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact vendor for updated firmware or mitigation guidance.
🔧 Temporary Workarounds
Disable Telnet Service
linuxDisable telnet service to prevent remote access via default credentials
killall telnetd
remove telnet from startup scripts
Change Root Password
linuxChange default root password to strong unique password
passwd root
🧯 If You Can't Patch
- Network segmentation: Isolate TX9 devices on separate VLAN with strict firewall rules
- Disable telnet service and use SSH with key-based authentication if remote access needed
🔍 How to Verify
Check if Vulnerable:
Attempt telnet connection to port 23 and test root login with password 059AnkJCheck Version:
Check device firmware version in web interface or via serial consoleVerify Fix Applied:
Verify telnet service is disabled and root password has been changed📡 Detection & Monitoring
Log Indicators:
- Failed/successful telnet authentication attempts
- Root login via telnet
Network Indicators:
- Telnet connections to port 23
- Unusual outbound connections from device
SIEM Query:
source_port=23 AND (event_type="authentication" OR event_type="login")