Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2020-3446— Cisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials Vulnerability

Quick assessment

Affected
Cisco Cisco Wide Area Application Services (WAAS)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cisco Enterprise NFV Infrastructure Software（NFVIS）是美国思科（Cisco）公司的一套NVF基础架构软件平台。该平台可以通过中央协调器和控制器实现虚拟化服务的全生命周期管理。 Cisco ENCS 5400-W Series和CSP 5000-W Series中的Virtual Wide Area Application Services (vWAAS)（带有NFVIS捆绑的镜像）存在信任管理问题漏洞，该漏洞源于用户账户使用了默认的静态密码。攻击者可借助该

AI Predicted 8.1 Difficulty: Easy EPSS 1.39% · P70
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-3446

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in Cisco Virtual Wide Area Application Services (vWAAS) with Cisco Enterprise NFV Infrastructure Software (NFVIS)-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances could allow an unauthenticated, remote attacker to log into the NFVIS CLI of an affected device by using accounts that have a default, static password. The vulnerability exists because the affected software has user accounts with default, static passwords. An attacker with access to the NFVIS CLI of an affected device could exploit this vulnerability by logging into the CLI. A successful exploit could allow the attacker to access the NFVIS CLI with administrator privileges.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco ENCS 5400-W Series和CSP 5000-W Series 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Enterprise NFV Infrastructure Software（NFVIS）是美国思科（Cisco）公司的一套NVF基础架构软件平台。该平台可以通过中央协调器和控制器实现虚拟化服务的全生命周期管理。 Cisco ENCS 5400-W Series和CSP 5000-W Series中的Virtual Wide Area Application Services (vWAAS)（带有NFVIS捆绑的镜像）存在信任管理问题漏洞，该漏洞源于用户账户使用了默认的静态密码。攻击者可借助该
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Cisco Cisco Wide Area Application Services (WAAS) n/a -

II. Public POCs for CVE-2020-3446

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-3446

请登录查看更多情报信息。

Same Patch Batch · Cisco · 2020-08-26 · 22 CVEs total

CVE-2020-3443 8.8 HIGH Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability
CVE-2020-3507 8.8 HIGH Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execu
CVE-2020-3506 8.8 HIGH Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execu
CVE-2020-3523 6.5 MEDIUM Cisco Data Center Network Manager Cross-Site Scripting Vulnerability
CVE-2020-3518 6.5 MEDIUM Cisco Data Center Network Manager Cross-Site Scripting Vulnerability
CVE-2020-3505 6.5 MEDIUM Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak Vulne
CVE-2020-3522 6.3 MEDIUM Cisco Data Center Network Manager Authorization Bypass Vulnerability
CVE-2020-3485 6.3 MEDIUM Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability
CVE-2020-3491 5.5 MEDIUM Cisco Vision Dynamic Signage Director Stored Cross-Site Scripting Vulnerability
CVE-2020-3520 5.5 MEDIUM Cisco Data Center Network Manager Information Disclosure Vulnerability
CVE-2020-3484 5.3 MEDIUM Cisco Vision Dynamic Signage Director Directory Traversal Information Disclosure Vulnerabi
CVE-2020-3521 5.3 MEDIUM Cisco Data Center Network Manager Read File Path Traversal Vulnerability
CVE-2020-3490 4.9 MEDIUM Cisco Vision Dynamic Signage Director Path Traversal Vulnerability
CVE-2020-3151 Cisco Connected Mobile Experiences Restricted Shell Escape Vulnerability
CVE-2020-3496 Cisco Small Business Smart and Managed Switches Denial of Service Vulnerability
CVE-2020-3466 Cisco DNA Center Cross-Site Scripting Vulnerabilities
CVE-2020-3440 Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability
CVE-2020-3519 Cisco Data Center Network Manager Path Traversal Vulnerability
CVE-2020-3439 Cisco Data Center Network Manager Stored Cross-Site Scripting Vulnerability
CVE-2020-3389 Cisco Hyperflex HX-Series Software Weak Storage Vulnerability

Showing top 20 of 22 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Cisco Wide Area Application Services (WAAS)
Same vendor: Cisco
Same weakness: CWE-798

V. Comments for CVE-2020-3446

No comments yet

Leave a comment