Weak Default Credentials in Thermo Fisher Torrent Suite Django Application

CVE-2025-54303

What is CVE-2025-54303?

The Thermo Fisher Torrent Suite Django application version 5.18.1 is susceptible to exploitation due to weak default credentials stored as fixtures within its Django ORM API. Specifically, the ionadmin user account is configured with a default password 'ionadmin', facilitating easy access for unauthorized users. Although the user guide advises changing default credentials, there is no enforced policy mandating this change for administrative accounts. Consequently, numerous deployments may continue to use these default credentials, leaving them vulnerable to unauthorized access and escalation of privileges.

References