Cisco released software updates to mitigate critical and high severity vulnerabilities.
The most serious of the issues is a critical vulnerability related to the existence of insecure default credentials in the NX-OS network operating system running on Cisco Nexus 3000 series and Nexus 3500 platform switches.
A remote, unauthenticated attacker could exploit the flaw to log into a vulnerable device with root privileges via an account that has a default and static password.
The problem is the account, created during installation, cannot end up changed or removed without affecting the system’s functionality.
The security hole affects Cisco Nexus 3000 Series Switches running NX-OS 6.0(2)U6(1), 6.0(2)U6(2), 6.0(2)U6(3), 6.0(2)U6(4), and 6.0(2)U6(5), and Cisco Nexus 3500 Platform Switches running versions 6.0(2)A6(1), 6.0(2)A6(2), 6.0(2)A6(3), 6.0(2)A6(4), 6.0(2)A6(5), and 6.0(2)A7(1). Users who cannot immediately install the updates that fix the issue can apply workarounds described in Cisco’s advisory.
Cisco also released a software update to patch a high severity denial-of-service (DoS) vulnerability in the SNMP input packet processor of Nexus 5500 and 5600 Platform switches, and Nexus 6000 series switches running NX-OS.
An unauthenticated attacker can exploit the flaw to remotely cause the SNMP application to restart by sending a specially crafted SNMP packet to the targeted device. A bad guy could cause the application to restart multiple times, which could lead to a system-level restart and a DoS condition.
The vulnerability affects NX-OS release 7.1(1)N1(1) and it ended up patched with the release of version 7.1(2)N1(1). No workarounds are available.
A different high severity DoS flaw was in NX-OS’s TCP stack. A remote, unauthenticated attacker can send a specially crafted TCP packet to a targeted device and cause it to enter a DoS condition.
The issue affects Cisco Nexus 1000V, 3000, 4000, 5000, 6000 and 7000 series switches, and Unified Computing System (UCS) running NX-OS.