Vulnerabilites related to cisco - srp520
var-201710-0035
Vulnerability from variot

Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913. The encryption key is hard-coded (CWE-321) SEC Consult of Stefan Viehböck According to the survey, many embedded devices are not unique X.509 Certificate and SSH It is said that it is accessible from the Internet using a host key. A hard-coded key in a firmware image or a repository stored by scanning the Internet scans.io ( In particular SSH And the result of SSL Certificate ) A device that uses a certificate whose fingerprint matches the data of can be determined to be vulnerable. Affected devices include household routers and IP From the camera VoIP Wide range of products. CWE-321: Use of Hard-coded Cryptographic Key http://cwe.mitre.org/data/definitions/321.html scans.io https://scans.io/ SSH Result of https://scans.io/series/ssh-rsa-full-ipv4 SSL Certificate https://scans.io/study/sonar.ssl In many vulnerable devices, certificate and key reuse is limited to a limited product line by a specific developer, but there are several examples where multiple developers use the same certificate or key. Or exist. These are common SDK Firmware developed using, or ISP Provided by OEM The root cause is the use of device firmware. Vulnerable equipment is impersonation and intermediary (man-in-the-middle) There is a possibility of being attacked or deciphering the communication contents. Perhaps the attacker can obtain authentication information and other sensitive information and use it for further attacks. Survey results and certificates SSH For more information on systems affected by host key issues, see SEC Consult See the blog post. Certificate https://www.sec-consult.com/download/certificates.html SSH Host key https://www.sec-consult.com/download/ssh_host_keys.html SEC Consult http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.htmlA remote attacker impersonates a user or intermediary (man-in-the-middle) There is a possibility of being attacked or deciphering the communication contents. As a result, confidential information may be leaked. The Cisco RV320 Dual Gigabit WAN VPN is a router product from Cisco Systems, USA. Multiple Cisco Products are prone to an information-disclosure vulnerability. Successful exploits will lead to other attacks. This issue is being tracked by Cisco Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913. The flaw stems from the fact that the program does not generate unique keys and certificates

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201710-0035",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "wap2000",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.0.8.0"
      },
      {
        "model": "rv315w",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.01.03"
      },
      {
        "model": "wet200",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.0.8.0"
      },
      {
        "model": "rv120w",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.0.5.9"
      },
      {
        "model": "wap200",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.0.6.0"
      },
      {
        "model": "wap4410n",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.0.7.8"
      },
      {
        "model": "rv320",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.3.1.10"
      },
      {
        "model": "rv220w",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.0.4.17"
      },
      {
        "model": "rv180w",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.0.5.4"
      },
      {
        "model": "srp520",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.01.29"
      },
      {
        "model": "wrv200",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.0.39"
      },
      {
        "model": "pvc2300",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.1.2.6"
      },
      {
        "model": "rv180",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.0.5.4"
      },
      {
        "model": "wrvs4400n",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.0.2.2"
      },
      {
        "model": "wap4400n",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "spa400",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.1.2.2"
      },
      {
        "model": "wvc2300",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.1.2.6"
      },
      {
        "model": "rvs4000",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.0.3.4"
      },
      {
        "model": "srw224p",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.0.2.4"
      },
      {
        "model": "srp520-u",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.2.6"
      },
      {
        "model": "wrp500",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.0.1.002"
      },
      {
        "model": "wrv210",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.0.1.5"
      },
      {
        "model": "rtp300",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.1.24"
      },
      {
        "model": "rv325",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.3.1.10"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "actiontec",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "d link",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "general electric",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "netcomm",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "sierra",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "technicolor",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "ubiquiti",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "unify",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "zte",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "c1000z",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "fr1000z",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "gs1900-24",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "gs1900-8",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1100-n",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1100-nh",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1121-ni",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1123-ac",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "nwa1123-ni",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "p-660hn-51",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "p-663hn-51",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "p8702n",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "pmg5318-b20a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "q1000",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "sbg3300-n000",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "sbg3300-nb00",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "sbg3500-n000",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg1312-b10a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg1312-b30a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg1312-b30b",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg4380-b10a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg8324-b10a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg8924-b10a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vmg8924-b30a",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "vsg1435-b101",
        "scope": null,
        "trust": 0.8,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "",
        "scope": null,
        "trust": 0.8,
        "vendor": "multiple vendors",
        "version": null
      },
      {
        "model": "rv320 dual gigabit wan vpn router",
        "scope": null,
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "rv325 dual gigabit wan vpn router",
        "scope": null,
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "rv325 dual wan gigabit vpn router",
        "scope": null,
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "rvs4000 4-port gigabit security router vpn",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "wrv210 wireless-g vpn router rangebooster",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "wap4410n wireless-n access point poe/advanced security",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "wrv200 wireless-g vpn router rangebooster",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "wrvs4400n wireless",
        "scope": null,
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "srw224p",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "2.0.2.4"
      },
      {
        "model": "wap4400n",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "wvc2300",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "1.1.2.6"
      },
      {
        "model": "rv180",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "1.0.5.4"
      },
      {
        "model": "wap200",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "2.0.6.0"
      },
      {
        "model": "wrvs4400n",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "2.0.2.2"
      },
      {
        "model": "rv180w",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "1.0.5.4"
      },
      {
        "model": "wap2000",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "2.0.8.0"
      },
      {
        "model": "pvc2300",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "1.1.2.6"
      },
      {
        "model": "wet200",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "2.0.8.0"
      },
      {
        "model": "wvc2300 wireless-g business internet video camera audio",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-0"
      },
      {
        "model": "wrvs4400n wireless-n gigabit security router vpn",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-2.0"
      },
      {
        "model": "wrv210 wireless-g vpn router rangebooster",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-0"
      },
      {
        "model": "wrv200 wireless-g vpn router rangebooster",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-0"
      },
      {
        "model": "wrp500 wireless-ac broadband router with phone ports",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "20"
      },
      {
        "model": "wet200 wireless-g business ethernet bridge",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "wap4410n wireless-n access point poe/advanced security",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-0"
      },
      {
        "model": "wap4400n wireless-n access point poe",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-0"
      },
      {
        "model": "wap2000 wireless-g access point poe",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-0"
      },
      {
        "model": "wap200 wireless-g access point poe/rangebooster",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-0"
      },
      {
        "model": "srw224p 24-port 2-port gigabit switch webview/poe",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "10/100+-0"
      },
      {
        "model": "spa400 internet telephony gateway with fxo ports",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "40"
      },
      {
        "model": "small business srp520-u models",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "small business srp520 models",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "rvs4000 4-port gigabit security router vpn",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-0"
      },
      {
        "model": "rv325 dual wan gigabit vpn router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "rv325 dual gigabit wan vpn router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "rv320 dual gigabit wan vpn router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "rv315w wireless-n vpn router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "rv220w wireless network security firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "rv180w wireless-n multifunction vpn router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "rv180 vpn router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "rv120w wireless-n vpn firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "rtp300 broadband router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "pvc2300 business internet video camera audio/poe",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "-0"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "db": "BID",
        "id": "78047"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-426"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-6358"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:zyxel:c1000z_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:fr1000z_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:gs1900-24_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:gs1900-8_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1100-n_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1100-nh_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1121-ni_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1123-ac_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:nwa1123-ni_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:p-660hn-51_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:p-663hn-51_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:p8702n_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:pmg5318-b20a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:q1000_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:sbg3300-n000_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:sbg3300-nb00_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:sbg3500-n000_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg1312-b10a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg1312-b30a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg1312-b30b_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg4380-b10a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg8324-b10a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg8924-b10a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vmg8924-b30a_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:zyxel:vsg1435-b101_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:misc:multiple_vendors",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Stefan Viehb\u00f6ck of SEC Consult.",
    "sources": [
      {
        "db": "BID",
        "id": "78047"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2015-6358",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2015-6358",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2015-6358",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2015-07863",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-84319",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.2,
            "id": "CVE-2015-6358",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2015-6358",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2015-6358",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2015-07863",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201511-426",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-84319",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "db": "VULHUB",
        "id": "VHN-84319"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-426"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-6358"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913. The encryption key is hard-coded (CWE-321) SEC Consult of Stefan Viehb\u0026#246;ck According to the survey, many embedded devices are not unique X.509 Certificate and SSH It is said that it is accessible from the Internet using a host key. A hard-coded key in a firmware image or a repository stored by scanning the Internet scans.io ( In particular SSH And the result of SSL Certificate ) A device that uses a certificate whose fingerprint matches the data of can be determined to be vulnerable. Affected devices include household routers and IP From the camera VoIP Wide range of products. CWE-321: Use of Hard-coded Cryptographic Key http://cwe.mitre.org/data/definitions/321.html scans.io https://scans.io/ SSH Result of https://scans.io/series/ssh-rsa-full-ipv4 SSL Certificate https://scans.io/study/sonar.ssl In many vulnerable devices, certificate and key reuse is limited to a limited product line by a specific developer, but there are several examples where multiple developers use the same certificate or key. Or exist. These are common SDK Firmware developed using, or ISP Provided by OEM The root cause is the use of device firmware. Vulnerable equipment is impersonation and intermediary (man-in-the-middle) There is a possibility of being attacked or deciphering the communication contents. Perhaps the attacker can obtain authentication information and other sensitive information and use it for further attacks. Survey results and certificates SSH For more information on systems affected by host key issues, see SEC Consult See the blog post. Certificate https://www.sec-consult.com/download/certificates.html SSH Host key https://www.sec-consult.com/download/ssh_host_keys.html SEC Consult http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.htmlA remote attacker impersonates a user or intermediary (man-in-the-middle) There is a possibility of being attacked or deciphering the communication contents. As a result, confidential information may be leaked. The Cisco RV320 Dual Gigabit WAN VPN is a router product from Cisco Systems, USA. Multiple Cisco Products are prone to an information-disclosure vulnerability. Successful exploits will lead to other attacks. \nThis issue is being tracked by Cisco Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913. The flaw stems from the fact that the program does not generate unique keys and certificates",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-6358"
      },
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "db": "BID",
        "id": "78047"
      },
      {
        "db": "VULHUB",
        "id": "VHN-84319"
      }
    ],
    "trust": 3.24
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#566724",
        "trust": 3.6
      },
      {
        "db": "NVD",
        "id": "CVE-2015-6358",
        "trust": 3.4
      },
      {
        "db": "BID",
        "id": "78047",
        "trust": 2.0
      },
      {
        "db": "SECTRACK",
        "id": "1034257",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1034255",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1034258",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1034256",
        "trust": 1.7
      },
      {
        "db": "JVN",
        "id": "JVNVU96100360",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-426",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-84319",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "db": "VULHUB",
        "id": "VHN-84319"
      },
      {
        "db": "BID",
        "id": "78047"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-426"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-6358"
      }
    ]
  },
  "id": "VAR-201710-0035",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "db": "VULHUB",
        "id": "VHN-84319"
      }
    ],
    "trust": 1.365750996923077
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      }
    ]
  },
  "last_update_date": "2024-11-23T22:25:43.673000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Zyxel to Fix SSH Private Key and Certificate Vulnerability (CVE-2015-7256)",
        "trust": 0.8,
        "url": "http://www.zyxel.com/support/announcement_SSH_private_key_and_certificate_vulnerability.shtml"
      },
      {
        "title": "Patches for multiple Cisco product information disclosure vulnerabilities",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/67387"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-295",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-84319"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-6358"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "http://www.kb.cert.org/vuls/id/566724"
      },
      {
        "trust": 2.6,
        "url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20151125-ci"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/78047"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1034255"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1034256"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1034257"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1034258"
      },
      {
        "trust": 1.6,
        "url": "http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.html"
      },
      {
        "trust": 0.8,
        "url": "http://blog.sec-consult.com/2016/09/house-of-keys-9-months-later-40-worse.html"
      },
      {
        "trust": 0.8,
        "url": "https://www.sec-consult.com/download/certificates.html"
      },
      {
        "trust": 0.8,
        "url": "https://www.sec-consult.com/download/ssh_host_keys.html"
      },
      {
        "trust": 0.8,
        "url": "https://scans.io/"
      },
      {
        "trust": 0.8,
        "url": "https://scans.io/series/ssh-rsa-full-ipv4"
      },
      {
        "trust": 0.8,
        "url": "https://scans.io/study/sonar.ssl"
      },
      {
        "trust": 0.8,
        "url": "https://censys.io"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6358"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7255"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7256"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7276"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8251"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/vu/jvnvu96100360/index.html"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7256"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-6358"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7255"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7276"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8251"
      },
      {
        "trust": 0.3,
        "url": "http://www.cisco.com/"
      },
      {
        "trust": 0.3,
        "url": "http://www.kb.cert.org/vuls/id/bluu-a2nqxj"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "db": "VULHUB",
        "id": "VHN-84319"
      },
      {
        "db": "BID",
        "id": "78047"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-426"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-6358"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "db": "VULHUB",
        "id": "VHN-84319"
      },
      {
        "db": "BID",
        "id": "78047"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-426"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-6358"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-11-25T00:00:00",
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "date": "2015-12-01T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "date": "2017-10-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-84319"
      },
      {
        "date": "2015-11-25T00:00:00",
        "db": "BID",
        "id": "78047"
      },
      {
        "date": "2016-02-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "date": "2015-11-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201511-426"
      },
      {
        "date": "2017-10-12T15:29:00.217000",
        "db": "NVD",
        "id": "CVE-2015-6358"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-09-06T00:00:00",
        "db": "CERT/CC",
        "id": "VU#566724"
      },
      {
        "date": "2015-12-01T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-07863"
      },
      {
        "date": "2017-11-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-84319"
      },
      {
        "date": "2015-11-25T00:00:00",
        "db": "BID",
        "id": "78047"
      },
      {
        "date": "2018-02-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-006907"
      },
      {
        "date": "2017-10-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201511-426"
      },
      {
        "date": "2024-11-21T02:34:50.923000",
        "db": "NVD",
        "id": "CVE-2015-6358"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-426"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Embedded devices use non-unique X.509 certificates and SSH host keys",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#566724"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "lack of information",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-426"
      }
    ],
    "trust": 0.6
  }
}

Vulnerability from fkie_nvd
Published
2017-10-12 15:29
Modified
2024-11-21 02:34
Severity ?
5.9 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913.
References
psirt@cisco.comhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-ciIssue Tracking, Patch, Vendor Advisory
psirt@cisco.comhttp://www.kb.cert.org/vuls/id/566724Third Party Advisory, US Government Resource
psirt@cisco.comhttp://www.securityfocus.com/bid/78047Third Party Advisory, VDB Entry
psirt@cisco.comhttp://www.securitytracker.com/id/1034255Third Party Advisory, VDB Entry
psirt@cisco.comhttp://www.securitytracker.com/id/1034256Third Party Advisory, VDB Entry
psirt@cisco.comhttp://www.securitytracker.com/id/1034257Third Party Advisory, VDB Entry
psirt@cisco.comhttp://www.securitytracker.com/id/1034258Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-ciIssue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/566724Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/78047Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1034255Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1034256Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1034257Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1034258Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
cisco rv320_firmware *
cisco rv320 -
cisco rv325_firmware *
cisco rv325 -
cisco rvs4000_firmware *
cisco rvs4000 -
cisco wrv210_firmware *
cisco wrv210 -
cisco wap4410n_firmware *
cisco wap4410n -
cisco wrv200_firmware 1.0.39
cisco wrv200 -
cisco wrvs4400n_firmware *
cisco wrvs4400n -
cisco wap200_firmware *
cisco wap200 -
cisco wvc2300_firmware *
cisco wvc2300 -
cisco pvc2300_firmware *
cisco pvc2300 -
cisco srw224p_firmware *
cisco srw224p -
cisco wet200_firmware *
cisco wet200 -
cisco wap2000_firmware *
cisco wap2000 -
cisco wap4400n_firmware *
cisco wap4400n -
cisco rv120w_firmware *
cisco rv120w -
cisco rv180_firmware *
cisco rv180 -
cisco rv180w_firmware *
cisco rv180w -
cisco rv315w_firmware *
cisco rv315w -
cisco srp520_firmware *
cisco srp520 -
cisco srp520-u_firmware *
cisco srp520-u -
cisco wrp500_firmware *
cisco wrp500 -
cisco spa400_firmware *
cisco spa400 -
cisco rtp300_firmware *
cisco rtp300 -
cisco rv220w_firmware *
cisco rv220w -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:rv320_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F503CBF1-C2FB-40ED-8DA4-85F233EC4F8F",
              "versionEndIncluding": "1.3.1.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7596F6D4-10DA-4F29-95AD-75B60F4670D6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:rv325_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE1BC6E1-8A83-438F-AE33-3AAED7DF1CBE",
              "versionEndIncluding": "1.3.1.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3435D601-EDA8-49FF-8841-EA6DF1518C75",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:rvs4000_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7881E4BC-6590-49C0-88C4-A21F2BE2B4FE",
              "versionEndIncluding": "2.0.3.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:rvs4000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC30BCF7-FA1A-44B3-8C58-17DFA939E7C7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wrv210_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E9D1511-2B20-4013-9504-0FE9A9B5220C",
              "versionEndIncluding": "2.0.1.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wrv210:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FA20862-B235-4230-8861-A59CF62CC65E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wap4410n_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB758D90-1888-42E3-9305-82F59D9C1891",
              "versionEndIncluding": "2.0.7.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wap4410n:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EFF89AC2-2A85-463C-A644-B3FA31A470FA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wrv200_firmware:1.0.39:*:*:*:*:*:*:*",
              "matchCriteriaId": "57B0AF22-058C-4273-8A3F-744692DFB77E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wrv200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F73575BC-B0E8-49A5-8E68-4D9B3109029D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wrvs4400n_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A1D37CC-A650-496D-B66B-62F69EFFFCCC",
              "versionEndIncluding": "2.0.2.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wrvs4400n:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC842A29-7A55-4474-B5AD-A6813FE16A7D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wap200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBC035F1-83DE-47F1-BF2D-72FE32E926BC",
              "versionEndIncluding": "2.0.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wap200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD50A4C8-8E79-4D0B-8D23-88425EFE9234",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wvc2300_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6F6D758-4D48-4D16-B54C-08F924D8623C",
              "versionEndIncluding": "1.1.2.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wvc2300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1122B4F-87D0-4030-9C4C-E811BBEAC51F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:pvc2300_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B3D0D5-BA35-44A7-A9AC-EFC38638424E",
              "versionEndIncluding": "1.1.2.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:pvc2300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "35B259F8-E3F8-44D0-9EDB-BC686F239CF6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:srw224p_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "72473F9C-4AD6-47AE-9568-D7451EB8DD09",
              "versionEndIncluding": "2.0.2.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:srw224p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B559090-2CB3-41E6-B9C8-EB83FC7AFE54",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wet200_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1B80159-909F-4B59-9DC6-34C1E508FCD1",
              "versionEndIncluding": "2.0.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wet200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "565A92B8-DF55-4F7D-B312-E1870728F27A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wap2000_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3751819E-FF92-4540-93D2-2D8F8427D826",
              "versionEndIncluding": "2.0.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wap2000:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4844B66-4D3A-4526-87A3-6C45B9360691",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wap4400n_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C17056F7-933C-45AD-8F75-64E4B9ADFB55",
              "versionEndIncluding": "-",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wap4400n:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D47B755E-277A-4FF5-B005-C7F28B191D6B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:rv120w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34E8DF08-06D6-46EE-AE4A-8FA11D3E1FB9",
              "versionEndIncluding": "1.0.5.9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:rv120w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "40465CA8-BE8B-4F15-8578-D8972C241D84",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:rv180_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A27C46AD-51E7-463F-A296-D4C6DF9B01F7",
              "versionEndIncluding": "1.0.5.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:rv180:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8BD67F3-98CE-4B03-8980-6791B753FDC9",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:rv180w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA690405-6AB8-4503-90AB-0B25F50F4776",
              "versionEndIncluding": "1.0.5.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:rv180w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5E3FBF6-4EB3-4C2F-AE0E-25F5765DD107",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:rv315w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EEDA17A-529D-455C-B608-DFCFEC4DD448",
              "versionEndIncluding": "1.01.03",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:rv315w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D7B47D7-4D6B-43BF-BF1C-E89C781DDD14",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:srp520_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "857DB576-9674-42E1-B122-0ACCD696818F",
              "versionEndIncluding": "1.01.29",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:srp520:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEE62C2A-30E6-4E0F-AC84-1A75F5032D22",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:srp520-u_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F87C7EB8-4AF8-484E-B90F-B5E2C77D7679",
              "versionEndIncluding": "1.2.6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:srp520-u:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4A12DCA-F804-4CC1-B1FE-EF4A182A9722",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:wrp500_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "67487247-39A1-4EF9-A451-3A2585CC7D54",
              "versionEndIncluding": "1.0.1.002",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wrp500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "78DAF22A-9A5A-4E55-AF0F-ED9969610411",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:spa400_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "26067A0B-6752-4008-A021-57A76AC84F26",
              "versionEndIncluding": "1.1.2.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:spa400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A20F9B77-999F-4B2E-8894-6D6AED4A92CC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:rtp300_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "114E7DD2-5C5F-40A2-A795-FF75FACB4567",
              "versionEndIncluding": "3.1.24",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:rtp300:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "78E72C11-E53D-4E29-802A-002F0229C158",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:rv220w_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9C4E5A6-88BB-4758-8222-369BAE95C14B",
              "versionEndIncluding": "1.0.4.17",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:rv220w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8620DFD9-E280-464E-91FF-2E901EDD49C0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples dispositivos con software de Cisco incorporado utilizan certificados X.509 embebidos y claves de host SSH embebidas en el firmware, lo que permite que atacantes remotos superen los mecanismos de protecci\u00f3n criptogr\u00e1fica y realicen ataques Man-in-the-Middle (MitM) sabiendo de estos certificados y claves de otra instalaci\u00f3n. Esto tambi\u00e9n se conoce por los siguientes Bug ID: CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899 y CSCuw90913."
    }
  ],
  "id": "CVE-2015-6358",
  "lastModified": "2024-11-21T02:34:50.923",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-10-12T15:29:00.217",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-ci"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/566724"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/78047"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1034255"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1034256"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1034257"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1034258"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-ci"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/566724"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/78047"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1034255"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1034256"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1034257"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1034258"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

cve-2015-6358
Vulnerability from cvelistv5
Published
2017-10-12 15:00
Modified
2024-08-06 07:22
Severity ?
Summary
Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913.
References
http://www.kb.cert.org/vuls/id/566724third-party-advisory, x_refsource_CERT-VN
http://www.securitytracker.com/id/1034258vdb-entry, x_refsource_SECTRACK
http://www.securityfocus.com/bid/78047vdb-entry, x_refsource_BID
http://www.securitytracker.com/id/1034255vdb-entry, x_refsource_SECTRACK
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-civendor-advisory, x_refsource_CISCO
http://www.securitytracker.com/id/1034257vdb-entry, x_refsource_SECTRACK
http://www.securitytracker.com/id/1034256vdb-entry, x_refsource_SECTRACK
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:22:20.764Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VU#566724",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/566724"
          },
          {
            "name": "1034258",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034258"
          },
          {
            "name": "78047",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/78047"
          },
          {
            "name": "1034255",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034255"
          },
          {
            "name": "20151125 Multiple Cisco Products Confidential Information Decryption Man-in-the-Middle Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-ci"
          },
          {
            "name": "1034257",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034257"
          },
          {
            "name": "1034256",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034256"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-11-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-12T14:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "VU#566724",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/566724"
        },
        {
          "name": "1034258",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034258"
        },
        {
          "name": "78047",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/78047"
        },
        {
          "name": "1034255",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034255"
        },
        {
          "name": "20151125 Multiple Cisco Products Confidential Information Decryption Man-in-the-Middle Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-ci"
        },
        {
          "name": "1034257",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034257"
        },
        {
          "name": "1034256",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034256"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2015-6358",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "VU#566724",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/566724"
            },
            {
              "name": "1034258",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034258"
            },
            {
              "name": "78047",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/78047"
            },
            {
              "name": "1034255",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034255"
            },
            {
              "name": "20151125 Multiple Cisco Products Confidential Information Decryption Man-in-the-Middle Vulnerability",
              "refsource": "CISCO",
              "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151125-ci"
            },
            {
              "name": "1034257",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034257"
            },
            {
              "name": "1034256",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034256"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2015-6358",
    "datePublished": "2017-10-12T15:00:00",
    "dateReserved": "2015-08-17T00:00:00",
    "dateUpdated": "2024-08-06T07:22:20.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}