By default, Schweitzer Engineering Laboratories installs with a default password. The #1 and #2 access level accounts have passwords of otter and tail, which are publicly known and documented. This allows attackers to trivially access the program or system and gain privileged access.
Classification
Location:
Remote / Network Access
Attack Type:
Authentication Management
Impact:
Loss of Integrity
Solution:
Workaround
Exploit:
Exploit Public
Disclosure:
Vendor Verified
OSVDB:
SCADA
Solution
Immediately after installation, change all default installed accounts to use a unique and secure password. When possible, change default account names to custom names as well.
