PT-2018-1099 · Cisco · Cisco Ios Xe

Published 2018-03-28 · Updated 2023-05-22 · CVE-2018-0150

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software versions 16.x and later

Description The issue is related to an undocumented user account with a default username and password, allowing an unauthenticated, remote attacker to log in to a device with privilege level 15 access. This account can be exploited to remotely connect to an affected device, potentially granting the attacker full access to the device. The vulnerability affects devices running Cisco IOS XE Software Release 16.x and later.

Recommendations For Cisco IOS XE Software versions 16.x and later, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. As a temporary workaround, consider changing the default username and password for the undocumented user account to prevent exploitation. Restrict access to the device to minimize the risk of exploitation until a patch is applied.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2018-00497

CVE-2018-0150

Affected Products

Cisco Ios Xe

References · 9

• https://osv.dev/vulnerability/CVE-2018-0150 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xesc · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00497 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0150 · Security Note
• http://securitytracker.com/id/1040579 · Note
• http://securityfocus.com/bid/103539 · Note
• http://proffy.info/modules.php?name=News&file=article&sid=2405 · Note
• https://threatpost.ru/cisco-patches-two-critical-rce-bugs-in-ios-xe-software/25363 · Note
• http://proffy.info/modules.php?name=News&file=article&sid=2405 · Note