PT-2019-1373 · Cisco · Cisco Aironet Active Sensor

Publicado 2019-02-06 · Atualizado 2019-10-09 · CVE-2019-1675

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Aironet Active Sensor versions prior to 1.2.8

Description A vulnerability in the default configuration of the Cisco Aironet Active Sensor exists due to a default local account with a static password. This account has privileges only to reboot the device. An attacker could exploit this vulnerability by guessing the account name and password to access the CLI, allowing them to reboot the device repeatedly and create a denial of service (DoS) condition. It is not possible to change the configuration or view sensitive data with this account.

Recommendations For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

BDU:2019-00735

CVE-2019-1675

Produtos afetados

Cisco Aironet Active Sensor

Referências · 6

• https://osv.dev/vulnerability/CVE-2019-1675 · Aviso do Fabricante
• https://securitylab.ru/vulnerability/497825.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1675 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-aas-creds · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00735 · Nota de Segurança
• http://securityfocus.com/bid/106944 · Nota