Software Engineering Institute

CWE-259: Use of Hard-coded Password

OpenELEC has a hard-coded root password. The root partition is by default read-only, preventing a user from changing the password once installed; furthermore, SSH access is enabled by default.

RasPlex is based on OpenELEC and therefore inherits this same problem.

According to RasPlex, "The root filesystem is read only (squashfs). This prevents the ability to change the root password, but also prevents an attacker from modifying the filesystem."

A remote attacker may gain root access to the device.

The CERT/CC is currently unaware of a full solution to this issue. Affected users may consider the following mitigations:

Disable SSH password access

Disable the use of password access to SSH, and enable SSH keys instead.

RasPlex notes that "users can simply disable SSH via the dialog if they are worried about being compromised."

Build with a different password

Developers may build their own distribution of OpenELEC or RasPlex from source and modify the root password at build time. Users should be aware however that this password is still hard-coded and may leave a user vulnerable to further attack; future password changes would require another rebuild and deployment.

Restrict network access

Use a firewall or similar technology to restrict access to trusted hosts, networks, and services.