ID: INFO-12

Title: SSH credentials stored as weak MD5 hash in world-readable location

Severity: Informational

CVSS Score: -

CVSS Vector String: -

Description: The Dropbear SSH daemon stores its authentication credentials in plaintext at /tmp/dropbear/dropbearpwd, protected only by an MD5 hash. The /tmp directory is world-readable, meaning any process running on the device can access this file. The MD5 hash was successfully reversed via an online rainbow table lookup, recovering the plaintext password. Although SSH access was ultimately rejected due to a shell allocation failure, the credentials remain exposed and could be leveraged if SSH access were restored or if the same credentials are reused elsewhere. Note that the default password was found to match the username.

Remediation: Store credentials outside of world-readable directories. Replace MD5 with a modern, salted hashing algorithm such as bcrypt or SHA-512. Enforce a non-default, strong password policy for SSH accounts.

More information: See System Hardening Analysis chapter.