what you don't know can hurt you

Cisco Common Service Platform Collector Hardcoded Credentials

Cisco Common Service Platform Collector Hardcoded Credentials
Posted Mar 14, 2019
Authored by David Coomber

The Cisco Common Service Platform Collector versions 2.7.2 through 2.7.4.5 and all releases of 2.8.x prior to 2.8.1.2 contain hardcoded credentials.

tags | advisory
systems | cisco
advisories | CVE-2019-1723
MD5 | b839ff1288a335fb85a4e9618cd7250d

Cisco Common Service Platform Collector Hardcoded Credentials

Change Mirror Download
Cisco Common Service Platform Collector - Hardcoded Credentials (CVE-2019-1723)
--
https://www.info-sec.ca/advisories/Cisco-Collector.html

Overview

"The Cisco Common Service Platform Collector (CSPC) is an SNMP-based
tool that discovers and collects information from the Cisco devices
installed on your network. The CSPC software provides an extensive
collection mechanism to gather various aspects of customer device
data. Information gathered by the collector is used by several Cisco
Service offers, such as Smart Net Total Care, Partner Support Service,
and Business Critical Services. The data is used to provide inventory
reports, product alerts, configuration best practices, technical
service coverage, lifecycle information, and many other detailed
reports and analytics for both the hardware and operating system (OS)
software."

(https://www.cisco.com/c/en/us/support/cloud-systems-management/common-services-platform-collector-cspc/products-installation-guides-list.html)

Issue

The Cisco Common Service Platform Collector (version 2.7.2 through
2.7.4.5 and all releases of 2.8.x prior to 2.8.1.2) contains hardcoded
credentials.

Impact

An attacker able to access the collector via SSH or console could use
the hardcoded credentials to gain a shell on the system and perform a
range of attacks.

Timeline

February 14, 2019 - Notified Cisco via psirt@cisco.com
February 14, 2019 - Cisco assigned a case number
February 18, 2019 - Cisco confirmed the vulnerability
February 20, 2019 - Cisco provided a tentative 60 day resolution timeline
February 21, 2019 - Provided comments on the proposed timeline
March 11, 2019 - Cisco advised that the issue has been resolved and
that a security advisory will be published on March 13, 2019

Solution

Upgrade to Common Service Platform Collector 2.7.4.6 or later
Upgrade to Common Service Platform Collector 2.8.1.2 or later

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190313-cspcscv

Acknowledgements

Thanks to the Cisco PSIRT for their timely response

Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    11 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close