Enterasys Networks Vertical Horizon Default Backdoor Account Vulnerability

Bugtraq ID:	14014
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 21 2005 12:00AM
Updated:	Jun 21 2005 12:00AM
Credit:	Jacek Lipkowski <[email protected]> disclosed this vulnerability.
Vulnerable:	Enterasys Networks Vertical Horizon VH-2402S 02.05.09.07 Enterasys Networks Vertical Horizon VH-2402S 02.05.00
Not Vulnerable:	Enterasys Networks Vertical Horizon VH-2402S 02.05.09.08

Enterasys Networks Vertical Horizon Default Backdoor Account Vulnerability

Enterasys Networks Vertical Horizon switch firmware has a built-in administrative account that cannot be disabled.

This vulnerability reportedly allows remote attackers to gain unauthorized administrative access to a target switch.

Enterasys Networks Vertical Horizon Default Backdoor Account Vulnerability

An exploit is not required.

Enterasys Networks Vertical Horizon Default Backdoor Account Vulnerability

Solution:
The vendor has released an advisory and updates (Firmware version: 2.05.09.08) to address this issue. Customers are advised to peruse the referenced advisory for further information regarding obtaining and applying appropriate updates.

Enterasys Networks Vertical Horizon Default Backdoor Account Vulnerability

References:

• Enterasys Networks Homepage (Enterasys Networks)
  
• Vertical Horizon Patch Release (Enterasys Networks)
  
• Undocumented account vulnerability in Enterasys Vertical Horizon switches (Jacek Lipkowski )