Cisco warned on Thursday that as a result of default encryption keys in three of its security products, customers are at risk of an unauthenticated remote attacker being able intercept traffic or gain access to vulnerable systems with root privileges.
In a security advisory published June 25, Cisco said that its Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) are vulnerable due to default SSH keys which could allow an unauthenticated, remote attacker to connect to an affected system with the privileges of the root user.
The networking giant has released free softwares updates to fix the flaws and said that its physical appliances are not affected by the vulnerabilities.
Specifically, Cisco said the affected appliances all have default authorized SSH keys and default SSH host keys.
The default authorized SSH key vulnerability (CVE-2015-4216) is a flaw in the remote support functionality of the virtual appliances, which if exploited, could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user.
“The vulnerability is due to the presence of a default authorized SSH key that is shared across all the installations of WSAv, ESAv, and SMAv,” Cisco said. “An attacker could exploit this vulnerability by obtaining the SSH private key and using it to connect to any WSAv, ESAv, or SMAv.”
The default SSH host keys vulnerability (CVE-2015-4217) is also a flaw in the remote support functions of the products and could allow an unauthenticated, remote attacker to decrypt and impersonate secure communication between any virtual content security appliances, Cisco said.
“At attacker with possession of compromised keys, who is able to intercept traffic between the WSAv or ESAv and a host it is communicating with, would be able to decrypt the communication with a man-in-the-middle attack,” the advisory explained.
Customers should patch immediately, as there are no workarounds for these vulnerabilities.
Fortunately, Cisco said that vulnerabilities were found during internal testing and security reviews, and the company is not aware of malicious exploitation of the vulnerabilities in the wild.
For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.
More from Mike Lennon
- Watch Now: Threat Detection and Incident Response Virtual Summit
- Registration Now Open: 2023 ICS Cybersecurity Conference | Atlanta
- NetRise Adds $8 Million in Funding to Grow XIoT Security Platform
- Virtual Event Today: Zero Trust Strategies Summit
- Virtual Event Tomorrow: Zero Trust Strategies Summit
- Watch: How to Build Resilience Against Emerging Cyber Threats
- Video: How to Build Resilience Against Emerging Cyber Threats
- Webinar Today: Understanding Hidden Third-Party Identity Access Risks
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
