Threat Level: green Handler on Duty: Basil Alawi S.Taher

SANS ISC: Cisco Security Advisory: Default Credentials - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Cisco Security Advisory: Default Credentials

(Feel free to sing along here if you know this song...)

Cisco released a Critical security advisory today that applies to the Cisco Nexus 3000 Series and 3500 Platform Switches.  It seems Cisco has a blind spot in their security testing program for this type of vulnerability to be a repeat offender in different products, as our own Daniel Wesemann pointed out 8 months ago with "Cisco Default Credentials - Again!"

 

Summary from the Cisco page:

"The vulnerability is due to a user account that has a default and static password. This account is created at installation and cannot be changed or deleted without impacting the functionality of the system. An attacker could exploit this vulnerability by connecting to the affected system using this default account. The account can be used to authenticate remotely to the device via Telnet (or SSH on a specific release) and locally on the serial console."

 

Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are available.

tony d0t carothers --gmail

Tony

150 Posts
ISC Handler
Feel free to sing along here if you know this song.
How does Cisco keep getting this wrong?
Anonymous

Posts
Quoting Anonymous:Feel free to sing along here if you know this song.
How does Cisco keep getting this wrong?


Let's all get together for the "Cisco Stomp", aka "Doin' the Hokey Security"
Anonymous

Posts
"Static Password" sounds to me like it's part of the firmware. Just like Fortinets and Juniper Network's latest issues..both being an encoded 'back door' of sorts.

Hopefully now, manufacturers will not do this anymore.
ct1600

3 Posts Posts
Quoting ct1600:Hopefully now, manufacturers will not do this anymore.


Thanks, I needed a laugh this morning.
Jaybone

27 Posts Posts

Sign Up for Free or Log In to start participating in the conversation!