Cisco Fixes Critical Flaw In Surveillance Appliances

Cisco has urged system administrators to patch the company’s Video Surveillance Manager software to fix a bug involving root account credentials that were mistakenly left hard-coded into devices.

The company gave the bug a ranking of 9.8 out of 10, emphasising that it is highly critical.

The issue involves credentials for a root-level administrator account that was created at some point during the development process and was never removed.

If attackers discovered the credentials they would be able to gain administrative access to any of the affected systems, effectively taking control of them.

Undocumented root account

“The vulnerability is due to the presence of undocumented, default, static user credentials for the root account of the affected software on certain systems,” Cisco said in its advisory.

“An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.”

The bug affects Cisco Video Surveillance Manager (VSM) releases 7.10, 7.11 and 7.11.1 on several of Cisco’s Connected Safety and Security Unified Computing System (UCS) appliances.

The affected models include CPS-UCSM4-1RU-K9, CPS-UCSM4-2RU-K9, KIN-UCSM5-1RU-K9 and KIN-UCSM5-2RU-K9, Cisco said.

The company says the software is affected if it was preinstalled by Cisco and is running on the UCS platforms listed above.

Administrator credentials

Releases earlier than VSM Software 7.9 are not affected, and neither are later versions if they were installed as updates to VSM 7.9. VSM Software on VMware’s ESXi platform is also unaffected.

The credentials for accessing the root account have not been publicly disclosed, and were found during internal testing, Cisco said. The fix removes the root-level account involved.

Cisco recently fixed a similar bug involving static credentials, which affected the Linux variant of Cisco’s network operating system IOS XE.

The bug was patched in March but last week extended its advisory to cover IOS XE software running on the Integrated Services Virtual Router (ISRv).

Other hard-coded passwords have been removed from Cisco’s Digital Network Architecture (DNA) Centre and Cisco Prime Collaboration Provisioning (PCP) software.

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

Microsoft Executive Indicates Departmental Hiring Slowdown

Amid concern at the state of the global economy, a senior Microsoft executive tells staff…

12 hours ago

Shareholders Sue Twitter, Elon Musk For Stock ‘Manipulation’

Disgruntled shareholders are now suing both Twitter and Elon Musk, over volatile share price swings…

13 hours ago

Google Faces Second UK Probe Over Ad Practices

UK's competition watchdog launches second investigation of Google's ad tech practices, and whether it may…

16 hours ago

Elon Musk Raises His Contribution To Twitter Acquisition

But one of Elon Musk's biggest backers on the Twitter board has tendered his resignation…

1 day ago

Broadcom Confirms VMware Acquisition For $61 Billion

Entry into cloud infrastructure software for US chip firm Broadcom after it confirms reports it…

1 day ago