Cisco has revealed that its Smart Software Manager On-Prem High Availability (HA) service has a vulnerability that could enable remote hackers to access a sensitive part of the system with a high-privileged account.
In an advisory, Cisco said the flaw is due to a system account that has a default and static password and is not under the control of the system administrator. There is no workaround for the flaw, said the advisory.
“An attacker could exploit this vulnerability by using this default account to connect to the affected system. A successful exploit could allow the attacker to obtain read and write access to system data, including the configuration of an affected device. The attacker would gain access to a sensitive portion of the system, but the attacker would not have full administrative rights to control the device,” the advisory stated.
Cisco said that vulnerable products include Cisco Smart Software Manager On-Prem releases earlier than 7-202001, if the High Availability (HA) feature is enabled. HA is not enabled by default. Cisco said that the HA feature must be enabled for Cisco Smart Software Manager On-Prem to be affected by the vulnerability described.
“To determine whether the HA feature is configured on a device, administrators can log in to the administrative web interface and look for the presence of the High Availability Status widget in the main dashboard. If the widget exists, HA is enabled. Administrators can also SSH to the system, enter onprem-console at the prompt, and issue the ha_status command at the CLI,” stated the advisory.
“There are no workarounds that address this vulnerability,” it added. However, the company has released free software updates that address the vulnerability in Cisco Smart Software Manager On-Prem releases 7-202001 and later.
Cisco’s Smart Software Manager helps customers manage their Cisco licences and product keys. This product also has a fairly niche component called ‘SSM On-Prem’, which allows for these licences and keys to be managed without sending data over the internet to a central SSM server, said Kieran Roberts, head of penetration testing at Bulletproof.
“This component contained vulnerability based on a static password that was configured by the vendor and was not configurable by the administrative user. In essence, this was a ‘hidden admin’ account. It should be noted that this issue would not provide an attacker with full administrative access, but it would provide access to ‘a sensitive part of the system’,” he told SC Media UK.
“It should also be noted that only SSM devices configured to use the HA (High Availability) service are vulnerable, and HA is not configured by default. In terms of mitigation, Cisco has already released a patch since the vulnerability was disclosed using ‘Responsible Disclosure’. If it is not possible to install the patch immediately, consideration should be given to turning off the HA service until the patch can be applied,” he added.