CVE-2023-20101 — Hard-coded Credentials in Cisco Emergency Responder

CWE-798 — Hard-coded Credentials5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.7%
top 27.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Emergency ResponderCisco Emergency Responder
Timeline
PublishedOct 4

Description

A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/emergency_responder12.5\(1\)su4
▶CVEListV5cisco/cisco_emergency_responder12.5(1)SU4

🔴Vulnerability Details

2
CVEList
CVE-2023-20101: A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, w↗2023-10-04
▶
GHSA
GHSA-58fq-3f6f-rpf2: A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, w↗2023-10-04
▶

📋Vendor Advisories

1
Cisco
Cisco Emergency Responder Static Credentials Vulnerability↗2023-10-04
▶

🕵️Threat Intelligence

1
Bleepingcomputer
Cisco fixes hard-coded root credentials in Emergency Responder↗2023-10-04
▶
CVE-2023-20101 — Hard-coded Credentials in Cisco | cvebase