Critical severity · published Mar 3, 2016
CVE-2016-1329
Cisco NX-OS 6.0(2)U6(1) through 6.0(2)U6(5) on Nexus 3000 devices and 6.0(2)A6(1) through 6.0(2)A6(5) and 6.0(2)A7(1) on Nexus 3500 devices has hardcoded credentials, which allows…
9.8
CVSS
3.7%
EPSS
No
On KEV
Description
Cisco NX-OS 6.0(2)U6(1) through 6.0(2)U6(5) on Nexus 3000 devices and 6.0(2)A6(1) through 6.0(2)A6(5) and 6.0(2)A7(1) on Nexus 3500 devices has hardcoded credentials, which allows remote attackers to obtain root privileges via a (1) TELNET or (2) SSH session, aka Bug ID CSCuy25800.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GF
Gs1900-10hp Firmware · Zyxel
before 2.50\(aazi.0\)c0; before 2.50\(aazi.0\)c0 · source: NVD
KF
Keymouse Firmware · Zzinc
3.08; 3.08 · source: NVD
OP
Opensolaris · Sun
snv_124; snv_124 · source: NVD
XF
X14j Firmware · Samsung
t-ms14jakucb-1102.5; t-ms14jakucb-1102.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-1329
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-1329
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-n3k
www.securitytracker.com
http://www.securitytracker.com/id/1035161
isc.sans.edu
https://isc.sans.edu/forums/diary/20795
More from X14j Firmware
8.8
CVE-2016-1010
Adobe Flash Player and AIR Integer Overflow Vulnerability
9.8
CVE-2015-5729
The Soft Access Point (AP) feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, which makes it easier for remote…
9.8
CVE-2016-0729
Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote…
8.8
CVE-2016-1005
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK…
8.8
CVE-2016-1002
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK…