Cisco: We've killed another critical hard-coded root password bug, patch urgently

This time a 9.8/10-severity hardcoded password has been found in Cisco's video surveillance software.

Cisco: Patch early, patch often

This article originally appeared on ZDNet.

Cisco has supplied a patch for its Video Surveillance Manager software to erase hardcoded default credentials for the root account.

Admins responsible for appliances running Cisco's surveillance software should urgently patch the flaw, which has a Common Vulnerability Scoring System (CVSS) version 3 score of 9.8 out of a possible 10.

The flaw would allow an attacker to control an affected system as root user if they discovered the default credentials.

"The vulnerability is due to the presence of undocumented, default, static user credentials for the root account of the affected software on certain systems," Cisco notes in its advisory.

"An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user."

SEE: Information security policy (Tech Pro Research)

The flaw, tracked as CVE-2018-15427, affects preinstalled instances of Cisco Video Surveillance Manager (VSM) Software Releases 7.10, 7.11, and 7.11.1 on four of the company's Connected Safety and Security Unified Computing System (UCS) appliances.

Affected models include CPS-UCSM4-1RU-K9, CPS-UCSM4-2RU-K9, KIN-UCSM5-1RU-K9, and KIN-UCSM5-2RU-K9.

Cisco said the flaw exists because it failed to disable the root account and default credentials before it installed the software. The user credentials have not been publicly disclosed, according to Cisco, which says it found the issue during internal testing.

The fix follows an update for a similar static credential flaw affecting the Linux variant of Cisco's networking operating system, IOS XE.

Cisco initially patched the flaw in March but clarified last week that it also affected IOS XE software running on its Integrated Services Virtual Router (ISRv).

The company this year has removed several hardcoded password bugs from its software, including one found in Digital Network Architecture (DNA) Center, and Cisco Prime Collaboration Provisioning (PCP) software.

Also see