# Tightrope Carousel signage appliance shipped with a default admin login

- Date: 2019-02-11
- Location: Global
- Type: Research
- Sector: Vendor
- CVE: CVE-2018-18929, CVE-2018-18930, CVE-2018-18931
- Products: [Carousel](https://signagelist.org/products/carousel/)

Researcher Drew Green found that the Tightrope Media Carousel Seneca HDn signage appliance, version 7.0.4.104, shipped with a default local admin username and password that was still in use on a client system. He used that access and a bulletin upload feature to reach remote code execution, and also reported a privilege escalation path to SYSTEM. He reported the issues to Tightrope in November 2018, published about 90 days later, and used Shodan to estimate exposed installations, though the search count is not in the excerpt available; Tightrope published a knowledgebase article with workarounds.

## Sources

- [Cybersecurity Researcher Finds Severe Vulnerabilities In Digital Signage Platform](https://invidis.com/sixteen-nine/2019/02/11/cybersecurity-researcher-finds-severe-vulnerabilities-in-digital-signage-platform/) (Sixteen Nine / Invidis)
- [Tightrope Carousel digital signage write-up by Drew Green](https://news.sophos.com/?p=439023) (Sophos Naked Security)
- [CVE-2018-18929](https://nvd.nist.gov/vuln/detail/CVE-2018-18929) (NIST NVD)
- [CVE-2018-18930](https://nvd.nist.gov/vuln/detail/CVE-2018-18930) (NIST NVD)
- [CVE-2018-18931](https://nvd.nist.gov/vuln/detail/CVE-2018-18931) (NIST NVD)
- [https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/](https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/)

Page: https://signagelist.org/incidents/2019-02-tightrope-carousel-signage-appliance-shipped-with-a/