CVE-2016-1984

Vulnerability

The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices contains a hardcoded password (1MB@tMaN) for a hidden backdoor account. This account has administrative privileges. Affected versions include those before 2016-01-20, with specific firmware versions such as v1.2.322 and v1.3.100 for the NX-1200, and many other models (e.g., NetLinx controllers, Enova switchers, Massio ControlPads) as listed in ICS-CERT advisory [2] and CERT/CC note [3].

Exploitation

An attacker can exploit this vulnerability remotely without authentication by connecting via SSH or HTTP to the device and logging in with the hardcoded credentials (1MB@tMaN). No special network position or user interaction is required, as the account is intentionally hidden but fully functional [1][4].

Impact

Successful exploitation grants the attacker full administrative access to the device. This can lead to complete compromise of confidentiality, integrity, and availability, including the ability to modify device configuration, intercept or disrupt AV control systems, and potentially pivot to other network resources [2][3].

Mitigation

AMX has released firmware updates to address the vulnerability. For NX-1200 and other affected models, fixed versions include v1.4.65 (for some products) and hotfixes for others. Users should upgrade to the latest firmware available from AMX. If patching is not immediately possible, limiting network access to the device via firewall rules and disabling unused services (SSH/HTTP) can reduce exposure [2][3].