ID: HIGH-01

Title: Root password hash publicly available online and reversible via rainbow table lookup

Severity: High

CVSS Score: 7.5

CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description: The root password hash was identified as being publicly available on the vendor’s website, specifically within the /etc/shadow file included in the GPL code artifact. The hash was submitted to an online rainbow table lookup service which returned a match, revealing the plaintext password. No physical access to a device is required to obtain the hash or recover the password. Additionally, the hash uses MD5crypt ($1$), a weak hashing algorithm by modern standards.

Remediation: Use a strong unique password for the root account. Replace MD5crypt with a modern hashing algorithm. Do not include credential files in publicly released source code artifacts.

More information: See OSINT chapter.