PT-2004-1000 · Cisco · Cisco Ios+1

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1775

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.0 through 12.1 Catalyst Operating Software (CatOS) versions 5.5 and 6.1

Description The issue allows a remote attacker to gain access to device service data via the SNMP protocol, potentially leading to administrative privileges. It affects the Cisco VACM (View-based Access Control MIB) and enables remote attackers to read and modify device configuration using the read-write community string.

Recommendations For Cisco IOS versions 12.0 through 12.1, consider restricting access to the SNMP protocol until a patch is available. For Catalyst Operating Software (CatOS) versions 5.5 and 6.1, restrict access to the read-write community string to minimize the risk of exploitation. As a temporary workaround, consider disabling the SNMP protocol on affected devices until a patch is available.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2014-00016

CVE-2004-1775

Affected Products

Catalyst Operating

Cisco Ios

References · 7

• https://bdu.fstec.ru/vul/2014-00016 · Security Note
• http://cisco.com/warp/public/707/ios-snmp-community-vulns-pub.shtml · Vendor Advisory
• http://kb.cert.org/vuls/id/645400 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-1775 · Security Note
• http://securityfocus.com/bid/5030 · Patch
• http://cisco.com/warp/public/707/cisco-sa-20010228-ios-snmp-community.shtml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6179 · Note