Shopify · Report #92633
The POS Firmware is leaking the root Password which can be used for unauthorized access to the device.
Informativestatus
3upvotes
9 Oct 2015disclosed
Summary
The Shopify Point of Sale application is compatible with a new EMV card reader from Miura. The researcher discovered that the firmware for this device contains a wifi password configured in wpa_supplicant (presumably used during factory tests). However, due to the absence of wifi interface on the Miura devices sold by Shopify, this was not considered to be an issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.