DHS ICS-CERT Alert for Samsung Data Management Server

Last night the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) issued a new alert for an unconfirmed vulnerability in the Samsung Data Management Server. According to the summary:

“ICS-CERT was made aware of a published report by an independent researcher specifying a hard-coded credential vulnerability in the Samsung Data Management Server. This vulnerability allows an attacker to remotely log in with administrative privileges via telnet or FTP. ICS-CERT has not validated this vulnerability.”

ICS-CERT has not confirmed the vulnerability and is working with the vendor to confirm and mitigate this reported vulnerability.