Executive Summary
| Summary | |
|---|---|
| Title | Cisco Modular Encoding Platform D9036 Software Default Credentials Vulnerability |
| Informations | |||
|---|---|---|---|
| Name | cisco-sa-20160120-d9036 | First vendor Publication | 2016-01-20 |
| Vendor | Cisco | Last vendor Modification | 2016-01-20 |
| Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability in Cisco Modular Encoding Platform D9036 Software could allow an unauthenticated, remote attacker to log in to the system shell with the privileges of the root user. The vulnerability occurs because the root user has a default and static password. This account is created at installation and cannot be changed or deleted without impacting the functionality of the system. An attacker could exploit this vulnerability by remotely connecting to the affected system via SSH using this account. Successful exploitation could allow the attacker to access the system with the privileges of the root user. In addition to the root user, the guest user account also has a default and static password. The guest account is created at installation and cannot be changed or deleted without impacting the functionality of the system. However, this account has limited privileges on the system. Cisco has released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-d9036 BEGIN PGP SIGNATURE Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWn6TYAAoJEIpI1I6i1Mx3xJUQAJOZjxsn7/qkGQWpKAFQJhLY E559YBm4mCUezDZw+p3hUGQFSpN2exZNIfEnslvllqY97WETvyh/z9Z/6odJuzYo Qu+C7iSnHmY4tg/zbKxao2nzI0Ny2xbHL6klTVB1MuwMMI/4pTJAdQdavwy8+AXc kwP3Pc/2Hp3ANc/BbQcIHvGn9z3cgJXNtEyuAkjOwQX2xxExp0LNGmJn/nV1HwHk tUO9WKMDHjtSj/kyYONUvvtAQJTsz7F51X2T4Ar0bfo/gopuUZu/ZPJqxxKTQs/b CceEVCTlxXSuX8hKQoDUaCgIYOrdBuKfjD8kxRojXz8oejHDgC90srCVLUrGhLZm /tOCPHyxOYfnvDwMOczm6VH29mPtl+EX453aAgGBl6wj7gMK8hS6gbzp3T3HZ2ai laQOhmbyjVHVizjkrVXceb1F5g+t+gRUE7EBPtICQ6jyhyg3jfTdIQvHjXDp/kCo X83A+RHvcExvH+w8o/5g3U0UwB5j25SYxIbIux0hMtQb+FNZSluGW5kS1c0+oNld I5sVlS46hJRV+wEpPg39blSgvZgDNbkFEpCZKa7rr7O7Y1QuCLVnG2dd012KvNXn f73QcNybP/pzOl5ckZKnun8S7KvVG/gDxGXremCuOrogc1fPjR05ILxAbLiEV5SX /vx5fHKOyWOAllpcOoiz =tkHe END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
| Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-255 | Credentials Management |
CPE : Common Platform Enumeration
Alert History
| Date | Informations |
|---|---|
| 2016-01-28 05:27:10 |
|
| 2016-01-28 05:22:52 |
|
