Cisco fixes hard-coded credentials and default SSH key issues

guest · Nov 4, 2021

Cisco fixes hard-coded credentials and default SSH key issues
November 4, 2021
https://www.bleepingcomputer.com/ne...coded-credentials-and-default-ssh-key-issues/

Cisco has released security updates to address critical security flaws allowing unauthenticated attackers to log in using hard-coded credentials or default SSH keys to take over unpatched devices.

CISA also encouraged users and administrators today to review Cisco's advisories and apply all the necessary updates to block attempts to take over impacted systems.
Click to expand...

Catalyst PON Switch hard-coded credentials
The first of the two flaws patched on Wednesday (tracked as CVE-2021-34795) comes with a perfect 10/10 CVSS score and was found in the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT).

"A vulnerability in the Telnet service of Cisco Catalyst PON Series Switches ONT could allow an unauthenticated, remote attacker to log in to the affected device by using a debugging account that has a default, static password," the company explains in an advisory published yesterday.
Cisco confirmed that CVE-2021-34795 does not impact Catalyst PON Switch CGP-OLT-8T and Catalyst PON Switch CGP-OLT-16T.
Click to expand...

Default SSH keys in Cisco Policy Suite
The second critical security flaw patched yesterday is tracked as CVE-2021-40119 and is caused by the re-use of static SSH keys across Cisco Policy Suite installations.

"A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system as the root user," Cisco explains.
To generate new SSH keys and propagate them to all machines, you can use the steps detailed in the Fixed Releases section of Cisco's advisory.
Click to expand...

Log in or Sign up

Cisco fixes hard-coded credentials and default SSH key issues

guest Guest

Log in or Sign up

Cisco fixes hard-coded credentials and default SSH key issues

guest Guest

Useful Searches