Amnezia Web Panel
Monthly
Use of default credentials in the PRVTPRO Amnezia Web Panel Backup Download feature (app.py) allows remote attackers to log in with the product's shipped default credential set and download backup data, exposing configuration and any secrets contained in those backups. Affected versions are through 1.6.2 and 1.7.2; publicly available exploit code exists, while there is no confirmed active exploitation (the CVE is not listed in CISA KEV). The CVSS v4.0 score is 6.9 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N and low confidentiality/integrity/availability impact, and the independent assessment agrees the path is remotely reachable with no user interaction and no legitimately provisioned account, limited primarily by whether the default credentials have been changed and whether the panel is reachable from untrusted networks.
Use of default credentials in the PRVTPRO Amnezia Web Panel Backup Download feature (app.py) allows remote attackers to log in with the product's shipped default credential set and download backup data, exposing configuration and any secrets contained in those backups. Affected versions are through 1.6.2 and 1.7.2; publicly available exploit code exists, while there is no confirmed active exploitation (the CVE is not listed in CISA KEV). The CVSS v4.0 score is 6.9 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N and low confidentiality/integrity/availability impact, and the independent assessment agrees the path is remotely reachable with no user interaction and no legitimately provisioned account, limited primarily by whether the default credentials have been changed and whether the panel is reachable from untrusted networks.