RVD#1877: Hard coded username makes pepper and NAO susceptible to a Brute force attack.

[glerapic]

{
    "id": 1877,
    "title": "RVD#1877: Hard coded username makes pepper and NAO susceptible to a Brute force attack.",
    "type": "vulnerability",
    "description": "The Default User (NAO) for the robot has a wide arrange of privileges including ssh access and configuration via browser. even though the user is prompted to change the password on first use, the user cannot be modified and there is no strength requirements for the password making it more vulnerable to a brute force attack. More so the default Credentials to the robot are publicly available on the user manual.",
    "cwe": "CWE-798",
    "cve": "N/A",
    "keywords": [
        "Pepper, NAO, Authentication"
    ],
    "system": "Pepper, NAO, Naoqi 2.5.11 and below",
    "vendor": "Softbank Robotics",
    "severity": {
        "rvss-score": 9.8,
        "rvss-vector": "RVSS:1.0/AV:AN/AC:L/PR:N/UI:N/Y:M/S:U/C:H/I:L/A:H/H:U",
        "severity-description": "Critical",
        "cvss-score": 9.4,
        "cvss-vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"
    },
    "links": [
        "https://cwe.mitre.org/data/definitions/798.html",
        "http://doc.aldebaran.com/2-4/family/pepper_user_guide/webpage.html#access-webpage-pep",
        "https://arxiv.org/pdf/1805.04101.pdf",
        "https://github.com/aliasrobotics/RVD/issues/1877"
    ],
    "flaw": {
        "phase": "testing",
        "specificity": "general-issue",
        "architectural-location": "Platform code",
        "application": "Embedded web-server",
        "subsystem": "UI:Login",
        "package": "N/A",
        "languages": "2020-05-25",
        "date-detected": null,
        "detected-by": "Offensive Team, Alias Robotics",
        "detected-by-method": "testing dynamic, web browser.",
        "date-reported": "2020-05-27",
        "reported-by": "Offensive Team, Alias Robotics",
        "reported-by-relationship": "Security researcher",
        "issue": "https://github.com/aliasrobotics/RVD/issues/1877",
        "reproducibility": "Always",
        "trace": "N/A",
        "reproduction": "N/A",
        "reproduction-image": "N/A"
    },
    "exploitation": {
        "description": "N/A",
        "exploitation-image": "N/A",
        "exploitation-vector": "N/A"
    },
    "mitigation": {
        "description": "This issue could be mitigated if the robot would not be delivered with the same standard user and password for all customers and strength requirements for the password are implemented.",
        "pull-request": "Since the actual state is already a fix from a prior, more precarious state, we can assume that this is a won't fix",
        "date-mitigation": null
    }
}