Cisco MSE Default oracle Account SSH Login Vulnerability (CVE-2015-6316)

Critical Vulnerability Information Vulnerability Name: Cisco Mobility Services Engine Static Credential Vulnerability Severity: High CVE ID: CVE-2015-6316 CWE ID: CWE-255 Cisco Bug ID: CSCuv40501 CVSS Score: Base 6.5, Temporal 5.4 Vulnerability Overview Description: The vulnerability exists in Cisco Mobility Services Engine (MSE), allowing an unauthenticated remote attacker to log in to the MSE using the default account. This account is created during installation and cannot be changed or deleted without breaking system functionality. Attackers can remotely connect via SSH to the affected system and log in using the default account. Affected Products Affected Versions: Cisco Mobility Services Engine (MSE) versions 8.0.120.7 and earlier. Command to Check Affected Version: - For versions below 10.0: - For versions 10.0 and above: Indicators of Exploitation Detection of SSH login attempts using the account in the device’s AAA server logs indicates exploitation of this vulnerability. Use the command to check if the account has logged in via SSH. Remediation and Workarounds Workaround: Edit the file to disable SSH login for the user. Fix: Upgrade to any version of MSE released after 8.0.120.7. Additional Information The vulnerability was discovered and reported by security researcher Jeremy Brown and the Beyond Security's SecuriTeam Secure Disclosure (SSD) team.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco MSE Default oracle Account SSH Login Vulnerability (CVE-2015-6316)