PT-2021-4961 · Cisco · Cisco Catalyst Pon Series Switches Optical Network Terminal
Published
2021-11-03
·
Updated
2022-04-25
·
CVE-2021-34795
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco Catalyst PON Series Switches Optical Network Terminal (ONT) (affected versions not specified)
Description
The issue is related to multiple vulnerabilities in the web-based management interface of the Cisco Catalyst PON Series Switches Optical Network Terminal (ONT). These vulnerabilities could allow an unauthenticated, remote attacker to log in with a default credential if the Telnet protocol is enabled, perform command injection, and modify the configuration. The vulnerability is also associated with insufficient input validation, which may allow a remote attacker to execute arbitrary code. The problem is only present when the Telnet protocol is activated in the settings, which is disabled by default.
Recommendations
As a temporary workaround, consider disabling the Telnet protocol to minimize the risk of exploitation.
Restrict access to the web-based management interface to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Access Control
Using Hardcoded Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Catalyst Pon Series Switches Optical Network Terminal