PT-2008-5161 · Cisco · Cisco Ubr10012+1

Published 2008-09-26 · Updated 2022-06-02 · CVE-2008-3807

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 and 12.3 on Cisco uBR10012 series devices

Description The issue allows remote attackers to obtain administrative access by guessing the SNMP community and sending SNMP requests. This is because the read/write SNMP service is enabled with a default community string private when linecard redundancy is configured.

Recommendations For Cisco IOS versions 12.2 and 12.3 on Cisco uBR10012 series devices, change the default SNMP community string private to a secure string to prevent unauthorized access. Consider disabling the SNMP service if it is not necessary for operations.

Fix

Related Identifiers

CVE-2008-3807

Affected Products

Cisco Ios

Cisco Ubr10012

References · 6

• http://cisco.com/en/US/products/products_security_advisory09186a0080a014b1.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3807 · Security Note
• http://secunia.com/advisories/31990 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5452 · Note
• http://vupen.com/english/advisories/2008/2670 · Note
• http://securitytracker.com/id?1020941 · Note