Cisco 2700 Series Wireless Location Appliance Default Administrator Password Vulnerability

Bugtraq ID:	20490
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 12 2006 12:00AM
Updated:	Oct 13 2006 05:39PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Cisco Cisco 2700 Series Wireless Location Appliance 2.1.33.0
Not Vulnerable:	Cisco Cisco 2700 Series Wireless Location Appliance 2.1.34.0

Cisco 2700 Series Wireless Location Appliance Default Administrator Password Vulnerability

The Cisco Wireless Location Appliance is prone to an authentication-bypass vulnerability because it has a default administrative password.

An attacker may use prior knowledge to log into the device to gain access to the device's administrative section. This could aid in further attacks.

Cisco 2700 Series Wireless Location Appliance versions prior to 2.1.34.0 are vulnerable.

Cisco 2700 Series Wireless Location Appliance Default Administrator Password Vulnerability

Attackers can exploit this issue through a telnet client.

Cisco 2700 Series Wireless Location Appliance Default Administrator Password Vulnerability

Solution:
The vendor has released version 2.1.34.0 to address this issue; please see the references for details.


Cisco Cisco 2700 Series Wireless Location Appliance 2.1.33.0

• Cisco Fix for Cisco Wireless Location Appliance prior to 2.1.34.0
  http://www.cisco.com/public/sw-center/sw-usingswc.shtml

Cisco 2700 Series Wireless Location Appliance Default Administrator Password Vulnerability

References:

• Cisco Security Advisory: Default Password in Wireless Location Appliance (Cisco Security)
  
• Cisco Wireless Product Page (Cisco)