Cisco Cable Access Router MIB Community Default Passwords Vulnerability
BID:3758
Info
Cisco Cable Access Router MIB Community Default Passwords Vulnerability
| Bugtraq ID: | 3758 |
| Class: | Design Error |
| CVE: |
CVE-2001-1210 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 31 2001 12:00AM |
| Updated: | Jul 11 2009 09:56AM |
| Credit: | This vulnerability was announced by <[email protected]> via the Bugtraq Mailing list on December 30, 2001. |
| Vulnerable: |
Cisco ubr925 Cisco ubr924 Cisco ubr920 |
| Not Vulnerable: | |
Discussion
Cisco Cable Access Router MIB Community Default Passwords Vulnerability
The ubr900 series routers are a Cable Access solution manufactured and maintained by Cisco Systems. They are designed to route traffic over cable networks.
Cisco ubr900 routers that conform to the DOCSIS standard provided by CableLabs may allow access by arbitrary users. The MIB supports default community strings xyzzy, agent_steal, freekevin, and fubar. These community strings allow a remote user to read and write information in the MIB, which could result in an attacker gaining access to sensitive information, or changing the configuration of the vulnerable router. This problem has been confirmed in models ubr920, ubr924, and ubr925.
The ubr900 series routers are a Cable Access solution manufactured and maintained by Cisco Systems. They are designed to route traffic over cable networks.
Cisco ubr900 routers that conform to the DOCSIS standard provided by CableLabs may allow access by arbitrary users. The MIB supports default community strings xyzzy, agent_steal, freekevin, and fubar. These community strings allow a remote user to read and write information in the MIB, which could result in an attacker gaining access to sensitive information, or changing the configuration of the vulnerable router. This problem has been confirmed in models ubr920, ubr924, and ubr925.
Exploit / POC
Cisco Cable Access Router MIB Community Default Passwords Vulnerability
No exploit is required to take advantage of this vulnerability.
No exploit is required to take advantage of this vulnerability.
Solution / Fix
Cisco Cable Access Router MIB Community Default Passwords Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Cisco Cable Access Router MIB Community Default Passwords Vulnerability
References:
References:
- Cisco uBR925 Cable Access Router Hardware Installation Guide (Cisco Systems)
- RFC 2669 (RFC Editor)