PT-2010-3245 · Cisco · Cisco Industrial Ethernet 3000+1

Michael Orlando · Publicado 2010-07-07 · Atualizado 2017-08-17 · CVE-2010-1574

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Industrial Ethernet 3000 series switches versions 12.2(52)SE through 12.2(52)SE1

Description The issue arises from the use of well-known SNMP community names, public for read-only access and private for read-write access, which are hard-coded in the system. This makes it easier for remote attackers to modify the configuration or obtain potentially sensitive information via SNMP requests.

Recommendations For versions 12.2(52)SE and 12.2(52)SE1, perform a Cisco IOS Software upgrade to a version that addresses this issue. As a temporary workaround, consider deploying the mitigation measures outlined in the Workarounds section to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-1574

Produtos afetados

Cisco Ios

Cisco Industrial Ethernet 3000

Referências · 10

• http://osvdb.org/66120 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1574 · Nota de Segurança
• http://securityfocus.com/bid/41436 · Nota
• http://securitytracker.com/id?1024173 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20100707-snmp · Aviso do Fabricante
• http://secunia.com/advisories/40407 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/732671 · Nota
• http://cisco.com/en/US/products/products_security_advisory09186a0080b3891f.shtml · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1754 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60145 · Nota