Scans for ESAFENET CDG 3 Document Management System Weak Logins, (Sun, Jul 26th)

ESAFENET's CDG showed up in our data before. The company focused on secure document management and data leakage prevention solutions. The CDG stands for Content Data Guard , and the product appears to be mostly targeting the Chinese market [1]. Sadly, like so many security products, it suffers from basic security vulnerabilities like SQL Injection, XSS, and default passwords. We have seen scanning for ESAFENET CDG before, in particular after the cross-site scripting vulnerability was made public. The scans we are seeing right now are going after the well-known default passwords that ESAFENET CDG ships with. Exploit scripts listing these passwords are, for example, included in a nulei template published in 2023 [2]. POST /CDGServer3/SystemConfig Host: [redacted] User-Agent: Mozilla/5.0 (Ubuntu; Linux i686; rv:124.0) Gecko/20100101 Firefox/124.0 Content-Length: 73 Accept: */* Accept-Language: en Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip Connection: close command=Login help=null verifyCodeDigit=dfd name=secadmin pass=Est@Spc820 This is a typical case of a password that will likely pass many standard security checks (10 characters, upper/lower case, special characters, and numbers), but it is still terribly insecure as it is a well-known default password. [1] https://esafenet.com [2] https://github.com/projectdiscovery/nuclei-templates/issues/7094 -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter | (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.