Executive Summary
| Summary | |
|---|---|
| Title | Cisco Nexus 3000 Series and 3500 Platform Switches Insecure Default Credentials Vulnerability |
| Informations | |||
|---|---|---|---|
| Name | cisco-sa-20160302-n3k | First vendor Publication | 2016-03-02 |
| Vendor | Cisco | Last vendor Modification | 2016-03-02 |
| Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability in Cisco NX-OS Software running on Cisco Nexus 3000 Series Switches and Cisco Nexus 3500 Platform Switches could allow an unauthenticated, remote attacker to log in to the device with the privileges of the root user with bash shell access. The vulnerability is due to a user account that has a default and static password. This account is created at installation and cannot be changed or deleted without impacting the functionality of the system. An attacker could exploit this vulnerability by connecting to the affected system using this default account. The account can be used to authenticate remotely to the device via Telnet (or SSH on a specific release) and locally on the serial console. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-n3k BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS) iQIVAwUBVs+jba89gD3EAJB5AQIoHQ/+LSC7mpmjWMBE/s4V1OPhISFGL2TgDt0m zgjKfHucx8TErAzhu+QhJcimw5AJj+rpxmIdlzkXysrwNYyyplCmFgE3r6iYrPkw Li9NWOCDk6ZUhvP7vbEeO+JKbsGnLtTNX29yHBuz0ayUj55Tzhs7IyxNIdEy+pJR 7yc4IPObdURRGOYa/iygWhvIA7OSCqmB/8uRo77SKgTkQ9dkYaDRdDQBD5LbsoQp X5RvAO9AWQYUkAwbMYZ3z7rlGHYAc44Dr8qcLSZIKolKb8GHaKI4y/5SDyH01BKw EgFIi03C8aejKBswnoSNJWO50tVSfFO8jqAA7MfQWHKWKDG89fJvf88HPMyp89La C2oU84dLQNjhkzfm5nv4QrIHuPUMZvU5fLS4k20kxBIQE7ru9dyMeJvO72EzGtt6 Q0PdzResUky4JN/YQ6JuzF7LkFjMS1XiyWJ9OD98bveRV3gVuxCFVHxSWnjkTPTb aJ6mSVFY94YmenLAiTh9MpJBNb4/EcXJRFEFaU/u426hcCOJJSc0oDvGtV/5nfGt N8C3FtyFxmNyqOyWV8qeHM7uHlgPjFhZZz2sNNYiGkt9K+AO/iSPMWNPKlJ/Rp3b Ht3QF9l8fFzmEWbpxvXCbLYAqkdXeRdZ1Z4HgKrLFLIAwghXF7sMDIvfF0CZldib mdRjmE16XQ4= =b3li END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
| Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-287 | Improper Authentication |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 1 | |
| Os | 1 | |
| Os | 1 | |
| Os | 1 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-03-03 | Name : The remote device is missing a vendor-supplied security patch. File : cisco-sn-CSCuy25800-nxos.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2016-03-19 09:28:52 |
|
| 2016-03-04 13:26:24 |
|
| 2016-03-03 00:24:54 |
|
| 2016-03-03 00:20:34 |
|
