CVE-2015-4216
published 2015-06-26CVE-2015-4216: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance…
PriorityP433medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
3.32%
87.2th percentile
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | content_security_management_virtual_appliance | — | — |
| cisco | content_security_management_virtual_appliance | — | — |
| cisco | email_security_virtual_appliance | — | — |
| cisco | email_security_virtual_appliance | — | — |
| cisco | email_security_virtual_appliance | — | — |
| cisco | email_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_cisco9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-775r-5j4x-p42j: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Ap
ghsa_unreviewed·2022-05-17
CVE-2015-4216 [MEDIUM] CWE-200 GHSA-775r-5j4x-p42j: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Ap
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.
Cisco
Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
vendor_cisco·2015-06-25·CVSS 9.3
CVE-2015-4216 [CRITICAL] CWE-310 Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
Cisco Web Security Virtual Appliance (WSAv), Cisco Email Security Virtual Appliance (ESAv), and Cisco Security Management Virtual Appliance (SMAv) are affected by the following vulnerabilities:
Cisco Virtual WSA, ESA, and SMA Default Authorized SSH Key Vulnerability
Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability
Cisco has released software updates that address these vulnerabilities.
There are no workarounds for these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport
Cisco
Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
vendor_cisco
CVE-2015-4216 Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
CVE-2015-4216: Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
Cisco Web Security Virtual Appliance (WSAv), Cisco Email Security Virtual Appliance (ESAv), and Cisco Security Management Virtual Appliance (SMAv) are affected by the following vulnerabilities: Cisco Virtual WSA, ESA, and SMA Default Authorized SSH Key Vulnerability Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability Cisco has released software updates that address these vulnerabilities. There are no
CWE: CWE-310, CWE-310
Bug IDs: CSCus29681, CSCuu95676, CSCuu95988, CSCus29681, CSCuu95676
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironporthttp://www.securityfocus.com/bid/75417http://www.securitytracker.com/id/1032725http://www.securitytracker.com/id/1032726http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironporthttp://www.securityfocus.com/bid/75417http://www.securitytracker.com/id/1032725http://www.securitytracker.com/id/1032726
2015-06-26
Published