CVE-2015-6316 Hardcoded credentials in n/a
Remote attackers can gain unauthorized access to Cisco MSE by using the hardcoded password for the oracle account in the default SSH configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-6316?
CVE-2015-6316 is a medium-severity vulnerability in n/a, published on 6 Nov 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The default configuration of sshd_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501.
Weakness: CWE-255
Which versions are affected by CVE-2015-6316?
It affects 1 product.
Products include Cisco Mobility Services Engine.
How do I fix CVE-2015-6316?
No fix has been published for CVE-2015-6316 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-6316 being exploited?
There is no known exploitation of CVE-2015-6316 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-0374 Missing authorization in Cisco Policy Suite unknown
- CVE-2018-0375 Hardcoded credentials in Cisco Policy Suite unknown
- CVE-2018-0376 Missing authorization in Cisco Policy Suite unknown
- CVE-2018-0377 Missing authorization in Cisco Policy Suite unknown
- CVE-2018-0116 Auth bypass in Cisco Policy Suite
Sources
Also known as GHSA-qh56-pj29-rjh8.