CVE Vulnerability

CVE-2019-1723

A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. The vulnerability exists because the affected software has a user account with a default, static password. An attacker could exploit this vulnerability by remotely connecting to the affected system using this account. A successful exploit could allow the attacker to log in to the CSPC using the default account. For Cisco CSPC 2.7.x, Cisco fixed this vulnerability in Release 2.7.4.6. For Cisco CSPC 2.8.x, Cisco fixed this vulnerability in Release 2.8.1.2.

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190313-cspcscv Patch Vendor Advisory
http://www.securityfocus.com/bid/107405 Third Party Advisory VDB Entry
https://www.info-sec.ca/advisories/Cisco-Collector.html Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:cisco:common_services_platform_collector:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:common_services_platform_collector:*:*:*:*:*:*:*:*
Information

Published : 2019-03-13 09:29

Updated : 2020-10-08 12:55

NVD link : CVE-2019-1723

Mitre link : CVE-2019-1723

Products Affected
No products.
CWE
CWE-798