EUVD-2025-201180
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user account can be used to authenticate to default deployments with the password ionadmin. The user guide recommends changing default credentials; however, a password change policy for default administrative accounts is not enforced. Many deployments may retain default credentials, in which case an attacker is likely to be able to successfully authenticate with administrative privileges.
Analysis
A remote code execution vulnerability in Thermo Fisher Torrent Suite Django application 5.18.1 (CVSS 9.8). Critical severity with potential for significant impact on affected systems.
Technical Context
Vulnerability type: remote code execution. CVSS 9.8 indicates critical severity with likely remote exploitation vector. Affects Thermo Fisher Torrent Suite Django application 5.18.1.
Affected Products
['Thermo Fisher Torrent Suite Django application 5.18.1']
Remediation
Monitor vendor channels for patch availability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today