Credentials management in Cisco Web Security Appliance - CVE-2017-6750
Published: May 16, 2018
Vulnerability identifier: #VU12768
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-6750
CWE-ID: CWE-255
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local unauthenticated attacker to obtain potentially sensitive information on the target system.
The weakness exists due to a user account that has a default and static password. A local attacker can connect to the target system using this default account, log in with the default credentials and view the system's serial number by using the CLI or download reports by using the web interface.
The weakness exists due to a user account that has a default and static password. A local attacker can connect to the target system using this default account, log in with the default credentials and view the system's serial number by using the CLI or download reports by using the web interface.
Affected software
Cisco Web Security Appliance
How to mitigate CVE-2017-6750
Update to versions 11.5.0-614, 10.5.1-296, 10.5.1-270 or 10.1.2-036.