Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2015-4216

Published: 26/06/2015 Updated: 28/12/2016
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Web Security Virtual Appliance

Vulnerability Summary

The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices prior to 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote malicious users to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.

Vulnerable Product Search on Vulmon Subscribe to Product

cisco web security virtual appliance 7.7.5

cisco email security virtual appliance 8.5.7

cisco email security virtual appliance 8.5.6

cisco email security virtual appliance 8.0.0

cisco web security virtual appliance 8.7.0

cisco content security management virtual appliance 9.0.0.087

cisco web security virtual appliance 8.5.1

cisco web security virtual appliance 8.0.5

cisco content security management virtual appliance 8.4.0.0150

cisco email security virtual appliance 9.0.0

cisco web security virtual appliance 8.6.0

cisco web security virtual appliance 8.5.0

Vendor Advisories

Cisco: Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
Cisco Web Security Virtual Appliance (WSAv), Cisco Email Security Virtual Appliance (ESAv), and Cisco Security Management Virtual Appliance (SMAv) are affected by the following vulnerabilities: Cisco Virtual WSA, ESA, and SMA Default Authorized SSH Key Vulnerability Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability Cis ...

References

CWE-200http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironporthttp://www.securityfocus.com/bid/75417http://www.securitytracker.com/id/1032726http://www.securitytracker.com/id/1032725https://nvd.nist.govhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
client sideCVE-2023-31889template injectionCVE-2024-4304CVE-2006-4304CVE-2024-33272type confusionCVE-2024-21345CVE-2024-33271
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook