CVE-2015-6316

Опубликовано: 06 нояб. 2015

Источник: nvd

CVSS2: 6.5

EPSS Низкий

Описание

The default configuration of sshd_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501.

Ссылки

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-mse-cred
Mitigation
Vendor Advisory
http://www.securityfocus.com/bid/77432
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1034065
Third Party Advisory
VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151104-mse-cred
Mitigation
Vendor Advisory
http://www.securityfocus.com/bid/77432
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1034065
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:mobility_services_engine:5.1_base:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:5.2_base:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:6.0_base:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:7.0_base:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:7.4.100.0:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:7.4.110.0:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:7.4.121.0:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:7.4_base:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:7.5.102.101:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:7.6.100.0:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:7.6.120.0:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:7.6.132.0:*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:8.0\(110.0\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:mobility_services_engine:8.0_base:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00713

Низкий

6.5 Medium

CVSS2

Дефекты

CWE-255

Связанные уязвимости

GHSA-qh56-pj29-rjh8

github

больше 3 лет назад