Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

UTStarcom BAS 1000 allows remote login with default accounts

CVE-2002-1936 · published 23 years ago
Summary

The BAS 1000 version 3.1.10 includes several built‑in user names and passwords that are left unchanged after installation. Because these credentials are known, anyone on the network can log in and control the device. Change or remove the default accounts immediately and apply any available firmware updates.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
utstarcom bas_1000 3.1.10
cpe:2.3:h:utstarcom:bas_1000:3.1.10:*:*:*:*:*:*:*
Original advisory text
UTStarcom BAS 1000 3.1.10 creates several default or back door accounts and passwords, which allows remote attackers to gain access via (1) field account with a password of "*field", (2) guru accou...
UTStarcom BAS 1000 3.1.10 creates several default or back door accounts and passwords, which allows remote attackers to gain access via (1) field account with a password of "*field", (2) guru account with a password of "*3noguru", (3) snmp account with a password of "snmp", or (4) dbase account with a password of "dbase".
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Timeline
Published31 Dec 2002
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2002-1936 · NVD
Track software like this
Free during beta