Songloft
Monthly
Songloft 2.9.0 through 2.13.5 ships an embedded Go backend that falls back to the fixed credential pair admin/admin whenever the administrator username and password are omitted from configuration, letting anyone who can reach the service on the local network log in as administrator through /api/v1/auth/login. From that session an attacker can rewrite library and configuration settings and install JavaScript plugins that execute inside the bundled QuickJS runtime, giving code execution in the server context; the mobile/embedded startup path binds 0.0.0.0, which is what makes the service LAN-reachable in the first place. The issue is unauthenticated from the network perspective (CVSS:4.0 AV:A/AC:L/PR:N/UI:N, 8.7; assessed as CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is bounded by two things: the attacker must be on an adjacent network, and operators who set a strong admin password are not affected. A public technical writeup describing the admin-takeover attack exists and is referenced by the CVE record, though it is not verified as working exploit code; vendor-released patch 2.13.6 is available and the priority label is this_week. No public exploit code is confirmed and the CVE is not listed as actively exploited (CISA KEV).
Songloft 2.9.0 through 2.13.5 ships an embedded Go backend that falls back to the fixed credential pair admin/admin whenever the administrator username and password are omitted from configuration, letting anyone who can reach the service on the local network log in as administrator through /api/v1/auth/login. From that session an attacker can rewrite library and configuration settings and install JavaScript plugins that execute inside the bundled QuickJS runtime, giving code execution in the server context; the mobile/embedded startup path binds 0.0.0.0, which is what makes the service LAN-reachable in the first place. The issue is unauthenticated from the network perspective (CVSS:4.0 AV:A/AC:L/PR:N/UI:N, 8.7; assessed as CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is bounded by two things: the attacker must be on an adjacent network, and operators who set a strong admin password are not affected. A public technical writeup describing the admin-takeover attack exists and is referenced by the CVE record, though it is not verified as working exploit code; vendor-released patch 2.13.6 is available and the priority label is this_week. No public exploit code is confirmed and the CVE is not listed as actively exploited (CISA KEV).