PT-2015-7176 · Cisco · Cisco Mobility Services Engine

Publicado 2015-11-06 · Atualizado 2017-01-06 · CVE-2015-6316

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Mobility Services Engine (MSE) versions through 8.0.120.7

Description The default configuration of sshd config in Cisco Mobility Services Engine allows logins by the oracle account, which has a hardcoded password. This makes it easier for remote attackers to obtain access by entering this account's password in an SSH session.

Recommendations For Cisco Mobility Services Engine (MSE) versions through 8.0.120.7, consider changing the hardcoded password of the oracle account or disabling the account altogether to prevent unauthorized access. As a temporary workaround, restrict SSH access to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2015-6316

Produtos afetados

Cisco Mobility Services Engine

Referências · 4

• http://securitytracker.com/id/1034065 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-mse-cred · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6316 · Nota de Segurança
• http://securityfocus.com/bid/77432 · Nota