Cisco: We've killed another critical hard-coded root password bug, patch urgently

Cisco has supplied a patch for its Video Surveillance Manager software to erase hardcoded default credentials for the root account.

Admins responsible for appliances running Cisco's surveillance software should urgently patch the flaw, which has a Common Vulnerability Scoring System (CVSS) version 3 score of 9.8 out of a possible 10.

The flaw would allow an attacker to control an affected system as root user if they discovered the default credentials.

"The vulnerability is due to the presence of undocumented, default, static user credentials for the root account of the affected software on certain systems," Cisco notes in its advisory.

"An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user."

The flaw, tracked as CVE-2018-15427, affects preinstalled instances of Cisco Video Surveillance Manager (VSM) Software Releases 7.10, 7.11, and 7.11.1 on four of the company's Connected Safety and Security Unified Computing System (UCS) appliances.

Affected models include CPS-UCSM4-1RU-K9, CPS-UCSM4-2RU-K9, KIN-UCSM5-1RU-K9, and KIN-UCSM5-2RU-K9.

Cisco said the flaw exists because it failed to disable the root account and default credentials before it installed the software. The user credentials have not been publicly disclosed, according to Cisco, which says it found the issue during internal testing.

The fix follows an update for a similar static credential flaw affecting the Linux variant of Cisco's networking operating system, IOS XE.

Cisco initially patched the flaw in March but clarified last week that it also affected IOS XE software running on its Integrated Services Virtual Router (ISRv).

The company this year has removed several hardcoded password bugs from its software, including one found in Digital Network Architecture (DNA) Center, and Cisco Prime Collaboration Provisioning (PCP) software.

Previous and related coverage

Cisco critical flaw warning: These 10/10 severity bugs need patching now

Cisco's software for managing software-defined networks has three critical, remotely exploitable vulnerabilities.

Cisco patches critical Nexus flaws: Are your switches vulnerable?

You'll need to wade through Cisco's advisories to work out if software you're running is vulnerable or already fixed.

Cisco: Update now to fix critical hardcoded password bug, remote code execution flaw

Cisco patches two serious authentication bugs and a Java deserialization flaw.

Cisco warns customers of critical security flaws, advisory includes Apache Struts

The massive security update includes a patch for the recently-disclosed Apache bug -- but not all products will be fixed yet.

Cisco updates ASR 9000 edge routing platform to carry users to 5G, multicloud world TechRepublic

New automation software, a new networking processor, and a new operating system will help Cisco customers make the transition to next-generation networking.

Apple and Cisco pool their might to shield companies from cyber risks CNET

Apple and Cisco join forces to protect businesses from risk of cyber threats.