Vulnerability Spotlight: Hard-coded password vulnerability could allow attacker to completely take over Lenovo Smart Clock
Summary: Cisco Talos researchers found that the Lenovo Smart Clock Essential, version 4.9.113, keeps its hardcoded credentials after setup, letting an attacker with network access gain full control of the device over SSH or telnet using a crafted command line argument. The default username is "root" and the default password is "123456", which Talos says a basic dictionary brute force cracked in under a second even on low-end hardware; Lenovo has released software version 90 or later to fix it.
What's compelling: The device carries a built-in microphone tied to Amazon Alexa, and its file system has enough room to install unwanted software or services, so anyone already on your network who guesses "123456" can take the clock over completely.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-0896
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026