Cisco SBS Privilege Escalation Vulnerability

Cisco have released details of a vulnerability in a number of their Small Business Switch (SBS) products.

Threat ID:: CC-2778
Category:
Threat Severity:: Medium
Threat Vector:: Insecure network
Published:: 9 November 2018 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Cisco have released details of a vulnerability in a number of their Small Business Switch (SBS) products.

Threat details

A remote attacker could exploit this vulnerability to bypass standard authentication mechanisms and gain access to an affected device.

By default, Cisco SBS products include a privileged account configuration that is used for initial login. This configuration is stored within a secure software enclave and cannot be viewed or removed; however, an administrator may be able to disable it by configuring at least one other user account with level 15 access privileges.

If the user-configured accounts are removed at any point the default configuration will be re-enabled without notifying administrators. A remote attacker could use known default credentials to exploit this in order to gain access to the affected switch, at which point they could then traverse the network.

For further information:

CVE-2018-15439

Remediation steps

Type	Step
	Cisco have confirmed that, at the time of publication, they are not producing software updates to address this vulnerability. They have instead recommended adding privilege level 15 accounts using the following commands: Switch# configure terminal Switch(config)# username admin privilege 15 password <strong_password> Accounts can be verified using the command show running-config \| include privilege 15. The output should match the following: Switch# show running-config \| include privilege 15 username admin password encrypted <encrypted-password> privilege 15

Type

Step

Cisco have confirmed that, at the time of publication, they are not producing software updates to address this vulnerability. They have instead recommended adding privilege level 15 accounts using the following commands:

Switch# configure terminal

Switch(config)# username admin privilege 15 password <strong_password>

Accounts can be verified using the command show running-config | include privilege 15. The output should match the following:

Switch# show running-config | include privilege 15

username admin password encrypted <encrypted-password> privilege 15

CVE Vulnerabilities

Status

CVE-2018-15439

Last edited: 17 February 2020 12:40 pm