CVE-2014-2198
HighSummary
Cisco Unified Communications Domain Manager (CDM) in versions before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to gain access to support and root accounts by extracting this key from a binary file found in a different installation of the product.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to critical system accounts, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade Cisco Unified Communications Domain Manager to version 4.4.2 or later to remove the hardcoded SSH key and minimize risk.
Other vulnerabilities in Cisco Unified Communications Domain Manager (CDM)
See all- CVE-2014-3300High
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) before version 10 does not properly implement access control, allowing remote attackers to modify user information via a crafted URL.
- CVE-2014-2197High
The Administration GUI in the web framework in Cisco Unified Communications Domain Manager (CDM) before version 8.1.4 does not properly implement access control, allowing remote authenticated users to modify administrative credentials via a crafted URL.
Original NVD description (English source)
Cisco Unified Communications Domain Manager (CDM) in Unified CDM Platform Software before 4.4.2 has a hardcoded SSH private key, which makes it easier for remote attackers to obtain access to the support and root accounts by extracting this key from a binary file found in a different installation of the product, aka Bug ID CSCud41130.