Cisco TANDBERG C Series and E/EX Series Default Credentials Authentication Bypass Vulnerability

Bugtraq ID:	46107
Class:	Design Error
CVE:	CVE-2011-0354
Remote:	Yes
Local:	No
Published:	Oct 24 2010 12:00AM
Updated:	Feb 03 2011 02:52PM
Credit:	2600 Magazine
Vulnerable:	Cisco Tandberg EX90 0 Cisco Tandberg EX60 0 Cisco Tandberg E20 0 Cisco Tandberg Codec C90 0 Cisco Tandberg Codec C60 0 Cisco Tandberg Codec C40 0 Cisco Tandberg Codec C20 0
Not Vulnerable:

Cisco TANDBERG C Series and E/EX Series Default Credentials Authentication Bypass Vulnerability

Cisco TANDBERG C Series Endpoints and E/EX Series Personal Video devices are prone to a remote authentication-bypass vulnerability.

An attacker can exploit this issue to gain unauthorized root access to the affected devices. Successful exploits will result in the complete compromise of the affected device.

Cisco TANDBERG C Series and E/EX Series Default Credentials Authentication Bypass Vulnerability

Attackers can use readily available tools to exploit this issue.

Cisco TANDBERG C Series and E/EX Series Default Credentials Authentication Bypass Vulnerability

Solution:
The vendor has released an advisory along with fixes. Please see the referenced advisory for more information.

Cisco TANDBERG C Series and E/EX Series Default Credentials Authentication Bypass Vulnerability

References:

• Cisco Security Advisory: Default Credentials for Root Account on Tandberg E, EX (Cisco)
  
• Tandberg Products (Cisco)
  
• Cisco Security Advisory: Default Credentials for Root Account on Tandberg E, EX (Cisco)
  
• Vulnerability Note VU#436854 Cisco Tandberg E, EX, and C Series default root cre (US-Cert)