CVE-2025-54303
CRITICAL
INFO
Priority: 0.04
BB Relevance:
80/100
Published: 2025-12-04
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user account can be used to authenticate to default deployments with the password ionadmin. The user guide recommends changing default credentials; however, a password change policy for default administrative accounts is not enforced. Many deployments may retain default credentials, in which case an attacker is likely to be able to successfully authenticate with administrative privileges.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| thermofisher | torrent_suite_software | 5.18.1 |
References & Advisories (3)
Vendor Advisory
Product
Release Notes
Product