Cisco IOS Virtual Console hard-coded credentials

Summaryinfo

A vulnerability has been found in Cisco IOS and classified as critical. This issue affects some unknown processing of the component Virtual Console. This manipulation causes hard-coded credentials. This vulnerability is handled as CVE-2020-3234. It is possible to launch the attack on the local host. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in Cisco IOS (Router Operating System) (the affected version unknown). Affected by this vulnerability is an unknown part of the component Virtual Console. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. The CWE definition for the vulnerability is CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the virtual console authentication of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an authenticated but low-privileged, local attacker to log in to the Virtual Device Server (VDS) of an affected device by using a set of default credentials. The vulnerability is due to the presence of weak, hard-coded credentials. An attacker could exploit this vulnerability by authenticating to the targeted device and then connecting to VDS through the device’s virtual console by using the static credentials. A successful exploit could allow the attacker to access the Linux shell of VDS as the root user.

The weakness was released 06/03/2020 as cisco-sa-ios-iot-vds-cred-uPMp as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2020-3234 since 12/12/2019. An attack has to be approached locally. A single authentication is necessary for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-156065, VDB-156064 and VDB-156060. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion