Security Updates: Attackers could infiltrate and take over Cisco PCP
The network equipment Cisco crams in some products, some critical vulnerabilities.
Cisco’s Prime Collaboration Provisioning Software (PCP) and Secure Access Control System (ACS) address critical security vulnerabilities. In both cases, attackers should be able to bring endangered devices under their control with comparatively little effort. Before that, and before gaps in other products, warns the network equipment supplier in his security center .
According to Cisco, the PCP software comes with a hard-coded password . So a local attacker could log into the underlying Linux system via SSH and acquire root privileges there. In this situation, the system is considered adopted.
Due to a lack of validation , attackers should be able to send crafted Java objects to Cisco’s ACS to execute malicious code. An attack should be able to take place remotely without authentication.
Further security holes
The Web Security Appliance’s FPT server has a vulnerability classified as “high” . This should be able to exploit an unannounced attacker remotely, so as to access the FTP server.
Cisco is filling additional gaps in, among other things, Identity Services Engine, IOS and StarOS. These vulnerabilities could exploit attackers for DoS or XSS attacks.