CVE-2013-0137

CVE-2013-0137 describes a critical vulnerability in Digital Alert Systems DASDEC and Monroe Electronics R189 One-Net EAS devices prior to version 2.0-2. These devices shipped with a hardcoded, known SSH private key in their default configuration. This flaw allows remote, unauthenticated attackers to gain root access to the devices via SSH, enabling them to spoof emergency alerts. The vulnerability carries a CVSS score of 10.0, indicating maximum severity due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. Its high EPSS score and FAUCET Risk Score of 98/100 further emphasize the significant risk. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit or ExploitDB, the inherent ease of exploitation due to the known private key makes it a serious concern. Despite its age, the lack of community discussion or media coverage does not diminish the potential impact if exploited.