← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2015-4667 · published 25 September 2017
CVE-2015-4667: Xceedium xsuite hard-coded credentials vulnerability
Xceedium · Xsuite
Multiple hardcoded credentials in Xsuite 2.x.
9.8 CVSS 3.0 Critical EPSS 11% · top 4.2% CWE-798 · Hard-coded credentials
9.8CVSS 3.0 base score, v2 7.5
11%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 4 tagged exploit
17 Jun 2026Last modified by NVD
Description
Multiple hardcoded credentials in Xsuite 2.x.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt | ExploitThird Party Advisory |
| http://www.securityfocus.com/archive/1/536058/100/0/threaded | |
| https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-pri | |
| https://www.exploit-db.com/exploits/37708/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt | ExploitThird Party Advisory |
| http://www.securityfocus.com/archive/1/536058/100/0/threaded | |
| https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-pri | |
| https://www.exploit-db.com/exploits/37708/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2015-4667 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
9.8CVE-2015-4664Broadcom privileged access manager improper input validation vulnerabilityAn improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.EPSS 21%7.8CVE-2015-4669Xceedium xsuite sql injection vulnerabilityThe MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system.EPSS 1.1%6.1CVE-2015-4668Xceedium xsuite open redirect vulnerabilityOpen redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attac…EPSS 6.7%5.0CVE-2015-4666Xceedium xsuite path traversal vulnerabilityDirectory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files v…EPSS 16%4.3CVE-2015-4665Xceedium xsuite cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in ajax_cmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers to inject arbitrary web scrip…EPSS 3.3%10.0CVE-2026-22769Dell RecoverPoint for Virtual Machines hardcoded credential flawDell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1 contain a hardcoded credential vulnerability (CWE-798). An unauthenticated remot…KEVEPSS 13%analysed7.1CVE-2025-14611Gladinet CentreStack and Triofox hardcoded AES key enables file inclusionCentreStack and Triofox before 16.12.10420.56791 use hardcoded values in their AES cryptoscheme, weakening protection for publicly exposed endpoints.…KEVEPSS 53%analysed6.5CVE-2019-6693FortiOS hard-coded key exposes backup file secretsFortiOS configuration backup files are encrypted with a hard-coded cryptographic key, so anyone who obtains a backup can decrypt the sensitive data i…KEVEPSS 5.8%analysed
Source: NIST National Vulnerability Database (record CVE-2015-4667), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
