CVE-2015-8362

Vulnerability

The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 contains a hardcoded password for the BlackWidow account [1][2][3]. This backdoor account, intended for debugging, was left in released firmware versions. Affected products include the NX-1200, NX-2200, NX-3200, NX-4200 (versions prior to 1.4.65); Massio ControlPads MCP-10x (prior to 1.4.65); Enova DVX-x2xx (prior to 1.4.65); DVX-31xxHD-SP / DVX-21xxHD-SP (prior to 4.8.331); DVX-2100HD-SP-T Master (prior to 4.1.420); Enova DGX masters (prior to 1.4.72 or 4.2.397 depending on model); NI-700/900 (prior to 4.1.419 or 3.60.456); NI-2100/3100/4100 series (prior to 4.1.419); and many others as listed in ICS-CERT advisory [2][3].

Exploitation

An unauthenticated remote attacker can connect to the device over SSH (port 22) or HTTP (port 80/443) and log in using the hardcoded credentials for the BlackWidow account [1][2]. No additional authentication, user interaction, or special privileges are required. The exploit vector is purely network-based, making it trivial to execute. Public exploit code is known to be available [2].

Impact

Successful login grants the attacker full administrative privileges over the affected AMX multimedia device [1][2][3]. This leads to a complete compromise of confidentiality (access to device configurations and AV streams), integrity (ability to modify settings or deploy malicious firmware), and availability (potential to disable the device). The attacker can also pivot to other network resources through the compromised device.

Mitigation

AMX has released hotfix firmware versions and updated releases to remove the hardcoded backdoor account. Patched versions include 1.4.65 for NX-series controllers and many models, 4.8.331 for DVX-31xx/21xxHD, 4.1.420 for DVX-2100HD-SP-T Master, 1.4.72 for Enova DGX NX masters, 4.2.397 for Enova DGX NI masters, 4.1.419 for NI-2100/3100/4100 series and NI-700/900, and 3.60.456 for NI-700/900 (32 MB RAM) [2]. Administrators should update affected devices to the specified firmware versions immediately. If patching is not possible, network access to SSH and HTTP services on AMX devices should be restricted using firewalls or VLAN segmentation [1].