Sign-up

ID

VAR-201603-0033


CVE

CVE-2016-1329


TITLE

Cisco Nexus 3000 and Nexus 3500 Run on device Cisco NX-OS In root Privileged vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-001817

DESCRIPTION

Cisco NX-OS 6.0(2)U6(1) through 6.0(2)U6(5) on Nexus 3000 devices and 6.0(2)A6(1) through 6.0(2)A6(5) and 6.0(2)A7(1) on Nexus 3500 devices has hardcoded credentials, which allows remote attackers to obtain root privileges via a (1) TELNET or (2) SSH session, aka Bug ID CSCuy25800. Cisco Nexus is Cisco's line of network switches designed for data centers. This vulnerability is caused by a user account created during installation that cannot be deleted or changed. The password is also static by default. Allows an unauthenticated remote attacker to log in to the device as root and has bashshell access. NX-OS Software is a data center operating system running on it

Trust: 2.34

sources: NVD: CVE-2016-1329 // JVNDB: JVNDB-2016-001817 // CNVD: CNVD-2016-01458 // VULHUB: VHN-90148 // VULMON: CVE-2016-1329

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-01458

AFFECTED PRODUCTS

vendor:ciscomodel:nx-os on nexus series switches 6.0 u6scope:eqversion:3000

Trust: 3.0

vendor:ciscomodel:nx-os on nexus platform switches 6.0 a6scope:eqversion:3500

Trust: 3.0

vendor:zzincmodel:keymousescope:eqversion:3.08

Trust: 1.0

vendor:samsungmodel:x14jscope:eqversion:t-ms14jakucb-1102.5

Trust: 1.0

vendor:sunmodel:opensolarisscope:eqversion:snv_124

Trust: 1.0

vendor:zyxelmodel:gs1900-10hpscope:ltversion:2.50\(aazi.0\)c0

Trust: 1.0

vendor:ciscomodel:nx-osscope:eqversion:6.0(2)a6(1) to 6.0(2)a6(5) (nexus 3500)

Trust: 0.8

vendor:ciscomodel:nx-osscope:eqversion:6.0(2)a7(1) (nexus 3500)

Trust: 0.8

vendor:ciscomodel:nx-osscope:eqversion:6.0(2)u6(1) to 6.0(2)u6(5) (nexus 3000)

Trust: 0.8

vendor:ciscomodel:nx-os on nexus platform switches 6.0 a7scope:eqversion:3500

Trust: 0.6

vendor:ciscomodel:nexus 3064scope:eqversion: -

Trust: 0.6

vendor:ciscomodel:nexus 3048scope:eqversion: -

Trust: 0.6

vendor:ciscomodel:nexus 3064tscope:eqversion: -

Trust: 0.6

vendor:ciscomodel:nexus 3548scope:eqversion: -

Trust: 0.6

vendor:ciscomodel:nexus 3524scope:eqversion: -

Trust: 0.6

vendor:ciscomodel:nexus 3064xscope:eqversion: -

Trust: 0.6

sources: CNVD: CNVD-2016-01458 // JVNDB: JVNDB-2016-001817 // CNNVD: CNNVD-201603-011 // NVD: CVE-2016-1329

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-1329
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-1329
value: HIGH

Trust: 0.8

CNVD: CNVD-2016-01458
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201603-011
value: CRITICAL

Trust: 0.6

VULHUB: VHN-90148
value: HIGH

Trust: 0.1

VULMON: CVE-2016-1329
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-1329
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2016-01458
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-90148
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-1329
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.0

sources: CNVD: CNVD-2016-01458 // VULHUB: VHN-90148 // VULMON: CVE-2016-1329 // JVNDB: JVNDB-2016-001817 // CNNVD: CNNVD-201603-011 // NVD: CVE-2016-1329

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.9

sources: VULHUB: VHN-90148 // JVNDB: JVNDB-2016-001817 // NVD: CVE-2016-1329

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201603-011

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201603-011

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-001817

PATCH
title:cisco-sa-20160302-n3kurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-n3k
Trust: 0.8
title:Patch for Cisco Nexus 3000/3500 Switch Default Credential Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/72206
Trust: 0.6
title:Cisco Nexus 3000 Series Switches  and Cisco Nexus 3500 Platform Switches NX-OS Software Fixes for permission permissions and access control vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60376
Trust: 0.6
title:The Registerurl:https://www.theregister.co.uk/2016/03/03/cisco_stitches_default_root_creds_for_switches/
Trust: 0.2
title:Cisco: Cisco Nexus 3000 Series and 3500 Platform Switches Insecure Default Credentials Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20160302-n3k
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-01458 // 
            
            
            
            VULMON: CVE-2016-1329 // 
            
            
            
            JVNDB: JVNDB-2016-001817 // 
            
            
            
            CNNVD: CNNVD-201603-011

EXTERNAL IDS
db:NVDid:CVE-2016-1329
Trust: 3.2
db:SECTRACKid:1035161
Trust: 1.2
db:JVNDBid:JVNDB-2016-001817
Trust: 0.8
db:CNNVDid:CNNVD-201603-011
Trust: 0.7
db:CNVDid:CNVD-2016-01458
Trust: 0.6
db:BIDid:83945
Trust: 0.2
db:SEEBUGid:SSVID-90923
Trust: 0.1
db:VULHUBid:VHN-90148
Trust: 0.1
db:VULMONid:CVE-2016-1329
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-01458 // 
            
            
            
            VULHUB: VHN-90148 // 
            
            
            
            VULMON: CVE-2016-1329 // 
            
            
            
            JVNDB: JVNDB-2016-001817 // 
            
            
            
            CNNVD: CNNVD-201603-011 // 
            
            
            
            NVD: CVE-2016-1329

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160302-n3k
Trust: 2.5
url:https://isc.sans.edu/forums/diary/20795
Trust: 1.8
url:http://www.securitytracker.com/id/1035161
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1329
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1329
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/287.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.securityfocus.com/bid/83945
Trust: 0.1
url:https://www.theregister.co.uk/2016/03/03/cisco_stitches_default_root_creds_for_switches/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-01458 // 
            
            
            
            VULHUB: VHN-90148 // 
            
            
            
            VULMON: CVE-2016-1329 // 
            
            
            
            JVNDB: JVNDB-2016-001817 // 
            
            
            
            CNNVD: CNNVD-201603-011 // 
            
            
            
            NVD: CVE-2016-1329

SOURCES
db:CNVDid:CNVD-2016-01458
db:VULHUBid:VHN-90148
db:VULMONid:CVE-2016-1329
db:JVNDBid:JVNDB-2016-001817
db:CNNVDid:CNNVD-201603-011
db:NVDid:CVE-2016-1329

LAST UPDATE DATE
2024-11-23T22:31:00.386000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-01458date:2016-03-08T00:00:00
db:VULHUBid:VHN-90148date:2016-12-03T00:00:00
db:VULMONid:CVE-2016-1329date:2016-12-03T00:00:00
db:JVNDBid:JVNDB-2016-001817date:2016-03-23T00:00:00
db:CNNVDid:CNNVD-201603-011date:2016-03-04T00:00:00
db:NVDid:CVE-2016-1329date:2024-11-21T02:46:11.900

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-01458date:2016-03-07T00:00:00
db:VULHUBid:VHN-90148date:2016-03-03T00:00:00
db:VULMONid:CVE-2016-1329date:2016-03-03T00:00:00
db:JVNDBid:JVNDB-2016-001817date:2016-03-23T00:00:00
db:CNNVDid:CNNVD-201603-011date:2016-03-03T00:00:00
db:NVDid:CVE-2016-1329date:2016-03-03T11:59:00.117