On Wednesday, Cisco told customers that a crucial default credentials vulnerability has been patched affecting certain configurations of its ENCS 5400-W series and CSP 5000-W series appliances.
The solution for the Cisco Wide Area Application Services (WAAS) is designed to manage traffic over the network of an enterprise. The Cisco Cloud Services Platform for WAAS (CSP-W) is a hardware platform designed to deploy Network Function Virtualization (NFV) datacenters, and the Cisco Enterprise Network Computer System (ENCS) is a hybrid platform for branch deployment and WAAS hosting.
External security research performed by Cisco showed that the standard, static password contains the virtual WAAS (vWAAS) with Enterprise NFV Infrastructure Software (NFVIS)-bundled images for ENCS 5400-W series and 5000-W series-appliances.
A remote, unauthenticated attacker may use this default account to log in with Administrator privileges to the NFVIS command line interface ( CLI).
The weakness, monitored as CVE-2020-3446, can be exploited by an attacker who can link to the NFVIS CLI of the targeted computer. This can be done via the CPU’s Ethernet management port in the case of ENCS devices, and a port on the I350 PCIe Ethernet Adapter Card in CSP devices. These interfaces can be accessed remotely if configured with a routed IP, Cisco explained.
An intruder can also exploit the vulnerability if they can gain access to the vWAAS CLI or the Cisco Integrated Management Controller (CIMC) and valid credentials.
“Cisco stated that this vulnerability does not affect standalone NFVIS running on Cisco ENCS 5000 Series and Cisco CSP 5000 Series devices, and does not affect standalone vWAAS or WAAS software running on Cisco Wide Area Virtualization Engine (WAVE) devices,” noted the company in its advisory.
On Wednesday, Cisco also informed customers of a high-severity vulnerability in Smart Software Manager (SSM) On-Prem that an authenticated attacker may exploit to escalate privileges.
In introducing the Discovery Protocol for Video Surveillance 8000 series IP cameras, the networking giant has also patched a high-severity problem that could allow an unauthenticated, adjacent attacker to execute arbitrary code or trigger the system to enter a DoS state.
The company also published advisories for a variety of medium-severity vulnerabilities that affect Webex, Data Center Network Manager, Small Business switches, Vision Dynamic Signage Operator, and many other products.
Cisco claims it is not aware of any threats taking advantage of these vulnerabilities.
