Cisco Energy Management Suite Installations Exposed by Default PostgreSQL Pass

guest · Dec 4, 2018

Cisco Energy Management Suite Installations Exposed by Default PostgreSQL Pass
Workaround available for the restriction bypass bug
December 4, 2018
https://news.softpedia.com/news/cis...posed-by-default-postgresql-pass-524110.shtml

CEMS is a software suite designed to provide its users with complete visibility of the energy use of all devices connected to the network used by the machine it is running on.

"The vulnerability is due to the installation of the PostgreSQL database with unchanged default access credentials. An attacker could exploit this vulnerability by logging in to the machine where CEMS is installed and establishing a local connection to the database," says Cisco's advisory.

The security issue which received the CVE-2018-0468 from the Common Vulnerabilities and Exposures database can be exploited by local attackers who also need to have access and log into an account.
As detailed by Cisco in their vulnerability report and the patch release notes, "The fix for this vulnerability randomizes the database access password in new installations; however, the fix will not change the password for existing installations."
Click to expand...

Log in or Sign up

Cisco Energy Management Suite Installations Exposed by Default PostgreSQL Pass

guest Guest

Log in or Sign up

Cisco Energy Management Suite Installations Exposed by Default PostgreSQL Pass

guest Guest

Useful Searches