Menu
Cisco leaves key to all its Unified CDM systems under doormat

Cisco leaves key to all its Unified CDM systems under doormat

Cisco's Unified Communications Domain Manager software contains a privileged account with a static password that can't be deleted or changed

Cisco Systems recently realized that its Unified Communications Domain Manager (Unified CDM) software contains a default privileged account with a static password that cannot be changed, exposing the platform to hacking by remote attackers.

The Cisco Unified CDM is part of the Cisco Hosted Collaboration System and provides automation and administrative functions for the Cisco Unified Communications Manager, Cisco Unity Connection, Cisco Jabber applications, associated phones and software clients.

The privileged account is created when Unified CDM is first installed and cannot be changed or removed without affecting the system's functionality -- although exactly how, Cisco didn't say in its security advisory. The only solution, the company said, is to install the patches it released.

If the flaw is left unfixed, remote attackers could potentially access the platform via SSH and log in with this default account, which has root privileges. This would provide them with full control over the affected system.

Cisco assigned the highest possible severity score -- 10 -- to the vulnerability based on the Common Vulnerability Scoring System (CVSS). This means that exploiting the flaw is easy and can lead to a complete compromise of the system's confidentiality, integrity and availability.

The vulnerability was fixed in the Unified CDM software version 4.4.5, but hotfixes are also available for versions 4.4.3 and 4.4.4 for customers with support contracts.

The issue was discovered by Cisco during internal security tests and the company is not aware of the flaw being exploited in the wild.

Default administrative accounts with hard-coded static passwords are a serious issue, but they're not a new occurrence in networking and other hardware appliances. They are the result of poor design decisions back in a time when security did not play an important role in product development.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags intrusionCisco SystemspatchesAccess control and authenticationExploits / vulnerabilities

Featured

Slideshows

EDGE 2019: Channel forges new partnerships during evening networking

EDGE 2019: Channel forges new partnerships during evening networking

Partners, vendors and distributors reconnected during a number of social gatherings during EDGE 2019. The first evening saw the channel congregate for a welcome party at the Hamilton Island yacht club, while the main poolside proved to be the perfect stop for a barbecue on the final night.

EDGE 2019: Channel forges new partnerships during evening networking
EDGE 2019: Thought leaders share how to build a channel of the future

EDGE 2019: Thought leaders share how to build a channel of the future

Day 2 of EDGE was opened by in-depth research from TRA's Tim Dillon, which outlined the partner view on the channel's future. The following day saw Forrester's Jay McBain and Odgers Berndtson's Tim Sleep conclude the keynote line-up, while HPE and Cisco rounded off the thought leadership.

EDGE 2019: Thought leaders share how to build a channel of the future
Show Comments