Critical Cisco Bug Opens Software Licencing Manager to Remote Attack

guest · Feb 20, 2020

Critical Cisco Bug Opens Software Licencing Manager to Remote Attack
February 20, 2020
https://threatpost.com/critical-cisco-bug-software-licencing-remote-attack/153086/

A critical flaw in the High Availability (HA) service of Cisco Smart Software Manager On-Prem Base has been uncovered, which would open the door to remote attackers thanks to its use of a static, default password, even if the platform isn’t directly connected to the internet.

According to Cisco’s product literature, the platform is aimed at “customers who have strict security requirements and do not want their products to communicate with the central licensing database on Smart Software Manager over a direct Internet connection,” like financial institutions, utilities, service providers and government organizations.

The hard-coded password is for “a [HA] system account [that] is not under the control of the system administrator,” Cisco said in an advisory issued Wednesday on the bug, tracked as CVE-2020-3158.

“Vulnerabilities like CVE-2020-3158 could not be any easier for attackers to compromise,” Chris Hass, director of information security and research at Automox, told Threatpost. “Systems with default, hardcoded credentials completely removes the need for any real technical skill, and drastically reduces the time to be weaponized.”
Click to expand...

The vulnerability, which has a score of 9.8 on the CVSS bug-severity scale, “could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account,” Cisco said.
Click to expand...

Log in or Sign up

Critical Cisco Bug Opens Software Licencing Manager to Remote Attack

guest Guest

Log in or Sign up

Critical Cisco Bug Opens Software Licencing Manager to Remote Attack

guest Guest

Useful Searches