PT-2016-7710 · Cisco · Cisco Ios Xr

Published 2016-12-07 · Updated 2016-12-22 · CVE-2016-9215

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software version 6.1.1.BASE

Description A vulnerability in Cisco IOS XR Software could allow an authenticated, local attacker to log in to the device with the privileges of the root user. The issue is due to a user account that has a default and static password, which an attacker could exploit by connecting to the affected system using this default account. This could allow the attacker to gain complete control of the underlying operating system.

Recommendations For Cisco IOS XR Software version 6.1.1.BASE, update the software to remove the default and static password for the affected user account to prevent exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-9215

Affected Products

Cisco Ios Xr

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-iosxr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9215 · Security Note
• http://securitytracker.com/id/1037418 · Note
• http://securityfocus.com/bid/94812 · Note