PT-2013-5603 · Cisco · Cisco Ios

Published 2013-10-25 · Updated 2013-10-25 · CVE-2013-5522

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS on Catalyst 3750X switches (affected versions not specified)

Description A vulnerability exists due to default Service Module credentials, allowing local users to gain privileges via a Service Module login. This issue makes it easier for an authenticated, local attacker to gain root access to the kernel running on the Cisco Service Module by logging in using the default credentials. An exploit could allow the attacker to take complete control of the operating system running on the service module. The vulnerability can be exploited by an attacker with local access to a targeted device, which may reside on trusted, internal networks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-5522

Affected Products

Cisco Ios

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-5522 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5522 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131025-CVE-2013-5522 · Note