CVE-2015-6389
HighSummary
Cisco Prime Collaboration Assurance before version 11.0 has a hardcoded cmuser account that allows remote attackers to gain access by establishing an SSH session and leveraging knowledge of this account's password.
Risk Assessment
Attackers can gain unauthorized access to the system, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade Cisco Prime Collaboration Assurance to version 11.0 or later and to change the password for the cmuser account to minimize risk.
Other vulnerabilities in Cisco Prime Collaboration Assurance
See all- CVE-2017-6659High
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.
- CVE-2015-4306High
The web framework in Cisco Prime Collaboration Assurance before version 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions and impersonate administrators of arbitrary tenant domains by discovering a session identifier and constructing a crafted URL.
- CVE-2015-4304High
The web framework in Cisco Prime Collaboration Assurance before version 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, enabling the creation of administrative accounts or reading data from arbitrary tenant domains via a crafted URL.
Original NVD description (English source)
Cisco Prime Collaboration Assurance before 11.0 has a hardcoded cmuser account, which allows remote attackers to obtain access by establishing an SSH session and leveraging knowledge of this account's password, aka Bug ID CSCus62707.