trixbox maint Web Interface Default Credentials

high Nessus Plugin ID 44874

Language:

Synopsis

A web application is protected using default credentials.

Description

The remote web server hosts the web interface for trixbox (or Asterisk@Home, as it was formerly known), a PBX application based on Asterisk.

The remote installation of this web interface has at least one account configured using default credentials. With this information, an attacker can gain administrative access to trixbox and, in turn Asterisk.

Solution

Change the password for the 'maint' user using, for example, the 'passwd-maint' shell script.

Plugin Details

Severity: High

ID: 44874

File Name: trixbox_maint_gui_default_creds.nasl

Version: 1.14

Type: remote

Family: CGI abuses

Published: 2/23/2010

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:fonality:trixbox

Required KB Items: www/PHP, www/trixbox

Excluded KB Items: global_settings/supplied_logins_only

Detections

Analytics