Cisco Security Advisory: Cisco Modular Encoding Platform D9036 Software Default Credentials Vulnerability

Cisco Modular Encoding Platform D9036 Software Default Credentials Vulnerability

Advisory ID: cisco-sa-20160120-d9036

Revision 1.0

For Public Release 2016 January 20 16:00  UTC (GMT)
+-----------------------------------------------------------
--------------------

Summary
=======
A vulnerability in Cisco Modular Encoding Platform D9036 Software could allow an unauthenticated, remote attacker to log in to the system shell with the privileges of the root user.

The vulnerability occurs because the root user has a default and static password. This account is created at installation and cannot be changed or deleted without impacting the functionality of the system. An attacker could exploit this vulnerability by remotely connecting to the affected system via SSH using this account. Successful exploitation could allow the attacker to access the system with the privileges of the root user.

In addition to the root user, the guest user account also has a default and static password. The guest account is created at installation and cannot be changed or deleted without impacting the functionality of the system. However, this account has limited privileges on the system.

Cisco has released software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are not available.

This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-d9036