CVE-2015-6358
Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913.
- Score
- CVSS 3.0 5.9 Medium
- Status
- Modified - psirt@cisco.com
- Published
- 2017-10-12
- Last modified
- 2024-08-06
- Weaknesses
- CWE-295
Affected products
- Pvc2300 Firmware (Cisco)
- Rtp300 Firmware (Cisco)
- Rv120w Firmware (Cisco)
- Rv180 Firmware (Cisco)
- Rv180w Firmware (Cisco)
- Rv220w Firmware (Cisco)
- Rv315w Firmware (Cisco)
- Rv320 Firmware (Cisco)
- Rv325 Firmware (Cisco)
- Rvs4000 Firmware (Cisco)
- Spa400 Firmware (Cisco)
- Srp520-u Firmware (Cisco)
- Srp520 Firmware (Cisco)
- Srw224p Firmware (Cisco)
- Wap2000 Firmware (Cisco)
- Wap200 Firmware (Cisco)
- Wap4400n Firmware (Cisco)
- Wap4410n Firmware (Cisco)
- Wet200 Firmware (Cisco)
- Wrp500 Firmware (Cisco)
- Wrv200 Firmware (Cisco)
- Wrv210 Firmware (Cisco)
- Wrvs4400n Firmware (Cisco)
- Wvc2300 Firmware (Cisco)
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-ci
- http://www.kb.cert.org/vuls/id/566724
- http://www.securityfocus.com/bid/78047
- http://www.securitytracker.com/id/1034255
- http://www.securitytracker.com/id/1034256
- http://www.securitytracker.com/id/1034257
- http://www.securitytracker.com/id/1034258
