PT-2015-7176 · Cisco · Cisco Mobility Services Engine

Published 2015-11-06 · Updated 2017-01-06 · CVE-2015-6316

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Mobility Services Engine (MSE) versions through 8.0.120.7

Description The default configuration of sshd config in Cisco Mobility Services Engine allows logins by the oracle account, which has a hardcoded password. This makes it easier for remote attackers to obtain access by entering this account's password in an SSH session.

Recommendations For Cisco Mobility Services Engine (MSE) versions through 8.0.120.7, consider changing the hardcoded password of the oracle account or disabling the account altogether to prevent unauthorized access. As a temporary workaround, restrict SSH access to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2015-6316

Affected Products

Cisco Mobility Services Engine

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-mse-cred · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6316 · Security Note
• http://securitytracker.com/id/1034065 · Note
• http://securityfocus.com/bid/77432 · Note