Local Authentication Bypass in Cisco Umbrella Insights Virtual Appliances
CVE-2017-12350
8.2HIGH
Key Information:
- Vendor
Cisco
- Vendor
- CVE Published:
- 16 November 2017
What is CVE-2017-12350?
A vulnerability exists in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier that allows an authenticated, local attacker to gain root access. This security flaw stems from default, hardcoded user credentials present in the affected systems. By utilizing the hypervisor console, an attacker can connect locally to the appliance and exploit these static credentials to log in with elevated privileges. This exposure can lead to unauthorized access, enabling the attacker to manipulate the appliance and potentially compromise the entire environment.
Affected Version(s)
Cisco Umbrella Insights Virtual Appliance Cisco Umbrella Insights Virtual Appliance