A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote malicious user to log in to a device running an affected release of Cisco IOS XE Software with the default username and password that are used at initial boot, aka a Static Credential Vulnerability. The vulnerability is due to an undocumented user account with privilege level 15 that has a default username and password. An attacker could exploit this vulnerability by using this account to remotely connect to an affected device. A successful exploit could allow the malicious user to log in to the device with privilege level 15 access. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software Release 16.x. This vulnerability does not affect Cisco IOS XE Software releases prior to Release 16.x. Cisco Bug IDs: CSCve89880.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
cisco ios_xe 16.5.1 |
Pick your poison in IOS and IOS XE: denial-of-service or remote code execution?
Cisco's ruined Easter for netadmins by revealing three critical-rated flaws, with fixes landing today. The company's IOS and IOS XE software need patching against two bugs, CVE-2018-0151 and CVE-2018-0171. CVE-2018-151 is a bounds-checking error in IOS/IOS XE's quality-of-service subsystem, and can be attacked using malicious packets to UDP port 18999. A successful attack triggers a buffer overrun, either causing a denial-of-service (DoS) or remote code execution (RCE). If you can't patch immedi...
Vulmon