====================================================================

                                   CERT-Renater

                        Note d'Information No. 2016/VULN034
_____________________________________________________________________

DATE                : 22/01/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Cisco Modular Encoding Platform D9036 Software.

======================================================================
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-d9036
_____________________________________________________________________

Cisco Modular Encoding Platform D9036 Software Default Credentials 
Vulnerability

Advisory ID: cisco-sa-20160120-d9036

Revision 1.0

For Public Release 2016 January 20 16:00  UTC (GMT)
+-------------------------------------------------------------------------------

Summary
=======
A vulnerability in Cisco Modular Encoding Platform D9036 Software could
allow an unauthenticated, remote attacker to log in to the system shell
with the privileges of the root user.

The vulnerability occurs because the root user has a default and static
password. This account is created at installation and cannot be changed
or deleted without impacting the functionality of the system. An
attacker could exploit this vulnerability by remotely connecting to the
affected system via SSH using this account. Successful exploitation
could allow the attacker to access the system with the privileges of
the root user.

In addition to the root user, the guest user account also has a default
and static password. The guest account is created at installation and
cannot be changed or deleted without impacting the functionality of the
system. However, this account has limited privileges on the system.

Cisco has released software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are not available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160120-d9036

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================