GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account which allows remote attackers to obtain administrative access and consequently execute arbitrary code by leveraging knowledge of the password.