====================================================================

                              CERT-Renater

                 Note d'Information No. 2016/VULN072
_____________________________________________________________________

DATE                : 24/02/2016

HARDWARE PLATFORM(S): Cisco Nexus 2000 Series Fabric Extender.

OPERATING SYSTEM(S): Cisco Nexus 2000 Series Fabric Extender Software.

======================================================================
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160223-nx2000
_____________________________________________________________________

Cisco Security Advisory

Cisco Nexus 2000 Series Fabric Extender Software Default Credential
Vulnerability

Medium

Advisory ID:
cisco-sa-20160223-nx2000

Published:
2016 February 23 00:00  GMT
Version 1.0:
Final

CVSS Score:
Base - 6.9

Workarounds:
No workarounds available

Cisco Bug IDs:
CSCur22079
CVE-2016-1341
CWE-287

Summary

      A vulnerability in the Cisco Nexus 2000 Series Fabric Extender
      could allow an unauthenticated, local attacker to log in to the
      system shell with root user privileges.

      The vulnerability is due to a missing password for the root user
      account on the affected system. This account is created at
      installation and cannot be changed or deleted without impacting the
      functionality of the system. An attacker could exploit this
      vulnerability by physically connecting to the affected system. An
      exploit could allow the attacker to access the system with root
      user privileges.

      Cisco has not released software updates that address this
      vulnerability.
      Workarounds that mitigate this vulnerability are not available.

      This advisory is available at the following link:
 
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160223-nx2000

Affected Products

      Vulnerable Products
      Cisco Nexus 2000 Series Fabric Extenders are vulnerable.
      Products Confirmed Not Vulnerable
      No other Cisco products are currently known to be affected by this
      vulnerability.

Workarounds

      Workarounds are not available.

Fixed Software

      When considering software upgrades, customers are advised to
      consult the Cisco Security Advisories and Responses archive at
      http://www.cisco.com/go/psirt and review subsequent advisories to
      determine exposure and a complete upgrade solution.

      In all cases, customers should ensure that the devices to upgrade
      contain sufficient memory and confirm that current hardware and
      software configurations will continue to be supported properly by
      the new release.
      If the information is not clear, customers are advised to contact
      the Cisco Technical Assistance Center (TAC) or their contracted
      maintenance providers.

Exploitation and Public Announcements

      The Cisco Product Security Incident Response Team (PSIRT) is not
      aware of any public announcements or malicious use of the
      vulnerability that is described in this advisory.

URL

 
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160223-nx2000

Revision History

      Version 	Description 		Section 	Status 	Date
      1.0 	Initial public release 		 	Final 	2016-February-23

Legal Disclaimer

      THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY
      ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
      MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
      INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT
      IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE
      THIS DOCUMENT AT ANY TIME.

      A standalone copy or paraphrase of the text of this document that
      omits the distribution URL is an uncontrolled copy and may lack
      important information or contain factual errors. The information in
      this document is intended for end users of Cisco products.

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================