Owners of wireless hard drives made by Seagate Technologies PLC are at risk of being hacked after it was discovered that certain drives were shipped with a vulnerability that delivered hackers easy access.

First discovered by Tangible Security, Inc. last week, the vulnerability is a strange one simply due to the absurd simplicity of it: affected devices are shipped with an undocumented Telnet service that is accessible over the internet by using the default credentials of “root” as the username and a default password.

If that’s not bad enough, the credentials are hard-coded into the device so it’s not simply a matter of owners hitting the control panel of the hard drives and switching it off to fix it.

Given access, an attacker is able to covertly take control of the device, not only compromising the confidentiality of files stored on it but use it as a platform to conduct malicious operations beyond the device.

Even worse, the newly identified vulnerability is one of several for the device, with others including affected device firmware providing unrestricted file download capability and an upload vulnerability that allows others on a shared WiFi network to gain access.

Security researcher Kenn White commented on the vulnerability on Twitter Sunday, writing that “People don’t expect DOD-level security but, Seagate, please stop adding hidden hardcoded root logins to hard drives.”

Are you vulnerable?

The good news is that Seagate has come to the party and provided a firmware update that fixes the issue, however getting users to update their firmware on an external hard drive is another matter.

Affected Seagate devices include:

• Seagate Wireless Plus Mobile Storage
• Seagate Wireless Mobile Storage
• LaCie FUEL

Firmware on the devices affected ranges from 2.2.0.005 and 2.3.0.014, dating to October 2014, however it is noted that other firmware versions may be affected.

“We urge users of these devices, including older and newer models, to download and install the latest firmware updates available from Seagate that address these vulnerabilities, “Tangible Security notes. “Failing to do so exposes those benefiting from the use of these devices to cybercrime risks.”

If you are using a Seagate device that needs to be updated and you’re looking for the new firmware, it can be downloaded here.

Image credit: vector_tf/Flickr/CC by 2.0