CVE-2019-1723 Cisco Common Services Platform Collector Static Credential Vulnerability

Critical 9.8 Published 13 Mar 2019 Updated 19 Nov 2024

An unauthenticated remote attacker can log in to Cisco CSPC using a default static password, gaining unauthorized access to the system.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1723?

CVE-2019-1723 is a critical vulnerability in Cisco Common Services Platform Collector Software, published on 13 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. The vulnerability exists because the affected software has a user account with a default, static password. An attacker could exploit this vulnerability by remotely connecting to the affected system using this account. A successful exploit could allow the attacker to log in to the CSPC using the default account. For Cisco CSPC 2.7.x, Cisco fixed this vulnerability in Release 2.7.4.6. For Cisco CSPC 2.8.x, Cisco fixed this vulnerability in Release 2.8.1.2.

Weakness: CWE-798, CWE-264

Which versions are affected by CVE-2019-1723?

It affects 1 product.

Products include Cisco Common Services Platform Collector.

How do I fix CVE-2019-1723?

No fix has been published for CVE-2019-1723 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-1723 being exploited?

There is no known exploitation of CVE-2019-1723 in the wild and no public exploit code.

Sources

Also known as GHSA-8gwv-jhp2-f22w.