BID:10076

Cisco WLSE/HSE Devices Default Username and Password Vulnerability

Info

Cisco WLSE/HSE Devices Default Username and Password Vulnerability

Bugtraq ID:	10076
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 07 2004 12:00AM
Updated:	Apr 07 2004 12:00AM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Cisco Wireless Lan Solution Engine 1130 2.0.5 Cisco Wireless Lan Solution Engine 1130 2.0 .2 Cisco Wireless Lan Solution Engine 1130 2.0 Cisco Wireless Lan Solution Engine 1105 2.5 Cisco Wireless Lan Solution Engine 1105 2.0.2 Cisco Wireless Lan Solution Engine 1105 2.0 Cisco Hosting Solution Engine 1105 1.7.3 Cisco Hosting Solution Engine 1105 1.7.2 Cisco Hosting Solution Engine 1105 1.7.1 Cisco Hosting Solution Engine 1105 1.7

Not Vulnerable:

Discussion

Cisco WLSE/HSE Devices Default Username and Password Vulnerability

It has been reported that Cisco Wireless LAN Solution Engine (WLSE) and Hosting Solution Engine (HSE) devices are prone to a hardcoded default username and password vulnerability. If logged in with the default credentials, an attacker can gain complete control over a device.

Successful exploitation could allow an attacker to gain access to sensitive data, compromise network integrity and confidentiality, cause denial of service attacks and use the devices to launch various attacks against other networks.

Exploit / POC

Cisco WLSE/HSE Devices Default Username and Password Vulnerability

Exploitation of this issue does not require an exploit.

Solution / Fix

Cisco WLSE/HSE Devices Default Username and Password Vulnerability

Solution:
Cisco has released an advisory cisco-sa-20040407 with fixes to address these issues.

Cisco Hosting Solution Engine 1105 1.7