PT-2010-3245 · Cisco · Cisco Industrial Ethernet 3000+1

Michael Orlando · Published 2010-07-07 · Updated 2017-08-17 · CVE-2010-1574

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Industrial Ethernet 3000 series switches versions 12.2(52)SE through 12.2(52)SE1

Description The issue arises from the use of well-known SNMP community names, public for read-only access and private for read-write access, which are hard-coded in the system. This makes it easier for remote attackers to modify the configuration or obtain potentially sensitive information via SNMP requests.

Recommendations For versions 12.2(52)SE and 12.2(52)SE1, perform a Cisco IOS Software upgrade to a version that addresses this issue. As a temporary workaround, consider deploying the mitigation measures outlined in the Workarounds section to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-1574

Affected Products

Cisco Ios

Cisco Industrial Ethernet 3000

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2010-1574 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20100707-snmp · Vendor Advisory
• http://secunia.com/advisories/40407 · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080b3891f.shtml · Vendor Advisory
• http://osvdb.org/66120 · Note
• http://securityfocus.com/bid/41436 · Note
• http://securitytracker.com/id?1024173 · Note
• http://kb.cert.org/vuls/id/732671 · Note
• http://vupen.com/english/advisories/2010/1754 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60145 · Note