Stories
Slash Boxes
Comments

SoylentNews is people

Hardcoded Password Found in Cisco Software

posted by martyb on Friday March 09 2018, @08:46PM   Printer-friendly
from the Cisco-Phencyclidine? dept.

Fnord666 writes:

Cisco released 22 security advisories yesterday, including two alerts for critical fixes, one of them for a hardcoded password that can give attackers full control over a vulnerable system.

The hardcoded password issue affects Cisco's Prime Collaboration Provisioning (PCP), a software application that can be used for the remote installation and maintenance of other Cisco voice and video products. Cisco PCP is often installed on Linux servers.

Cisco says that an attacker could exploit this vulnerability (CVE-2018-0141) by connecting to the affected system via Secure Shell (SSH) using the hardcoded password.

The flaw can be exploited only by local attackers, and it also grants access to a low-privileged user account. In spite of this, Cisco has classified the issue as "critical."

Although this vulnerability has a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which is normally assigned a Security Impact Rating (SIR) of Medium, there are extenuating circumstances that allow an attacker to elevate privileges to root. For these reasons, the SIR has been set to Critical.

The reasons are that an attacker can infect another device on the same network and use it as a proxy for his SSH connection to the vulnerable Cisco PCP instance, allowing for remote, over-the-Internet exploitation.

Source: https://www.bleepingcomputer.com/news/security/hardcoded-password-found-in-cisco-software/

Original Submission

 
This discussion has been archived. No new comments can be posted.
Hardcoded Password Found in Cisco Software | Log In/Create an Account | Top | 23 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 1, Informative) by Ethanol-fueled on Friday March 09 2018, @10:40PM (3 children)

    by Ethanol-fueled (2792) on Friday March 09 2018, @10:40PM (#650280) Homepage

    It is a rubber-stamp process. But you are not American. I am. We will destroy you.

    Starting Score:    1  point
    Moderation   0  
       Troll=1, Informative=1, Total=2
    Extra 'Informative' Modifier   0  
    Total Score:   1  

  • (Score: 3, Funny) by insanumingenium on Friday March 09 2018, @10:56PM (2 children)

    by insanumingenium (4824) on Friday March 09 2018, @10:56PM (#650290) Journal

    Riiiight, guess I will have to turn in my passport, guns, and pet bald eagle now.

    • (Score: 3, Funny) by LoRdTAW on Saturday March 10 2018, @01:28AM (1 child)

      by LoRdTAW (3755) on Saturday March 10 2018, @01:28AM (#650326) Journal

      You forgot bacon, or are you one of "those" people?

      • (Score: 2) by insanumingenium on Monday March 12 2018, @03:38PM

        by insanumingenium (4824) on Monday March 12 2018, @03:38PM (#651370) Journal
        Nah, both the Brits and Canadians love bacon too (though neither of them is talking about exactly the same bacon).

        You can take my pork from my cold dead hands μολὼν λαβέ.