PT-2018-8641 · Cisco · Cisco Prime Collaboration Provisioning

Publicado 2018-03-08 · Atualizado 2019-10-09 · CVE-2018-0141

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Prime Collaboration Provisioning (PCP) Software version 11.6

Description: A vulnerability exists due to a hard-coded account password, allowing an unauthenticated, local attacker to log in to the underlying Linux operating system. The attacker could exploit this by connecting via Secure Shell (SSH) using the hard-coded credentials, gaining access as a low-privileged user. The attacker could then elevate to root privileges, taking full control of the device.

Recommendations: For Cisco Prime Collaboration Provisioning (PCP) Software version 11.6, update the system to remove the hard-coded account password and ensure all default passwords are changed to prevent unauthorized access. As a temporary workaround, consider disabling SSH access to the affected system until a patch is available. Restrict access to the underlying Linux operating system to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-0141

Produtos afetados

Cisco Prime Collaboration Provisioning

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0141 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp · Aviso do Fabricante
• http://securityfocus.com/bid/103329 · Nota
• http://securitytracker.com/id/1040462 · Nota
• https://osv.dev/vulnerability/CVE-2018-0141 · Aviso do Fabricante