Cisco stitches default root creds for switches

Cisco has slung patches at its Nexus 3000 and 3500 switches to shutter a default remotely-accessible administrative account. The critical bug (CVE-2016-1329) grant attackers root access, according to Cisco security wonks. Admins can shut off Telnet as a workaround in place of the patch. "[The vulnerability] could allow an …

[justincormack]

surely?

If you didnt shut off telnet in 2001 you suck.

[Dan Wilkie]

Re: surely?

Last time I touched production Cisco kit was 2015. None of it was configured on SSH as it was old, didn't have K9 firmware, and they wouldn't replace them or put them on a smartnet so no SSH.

Public sector is terrible for that kind of thing. The year before I'd also seen people using the SNMP write community strings as well!

[Anonymous Coward]

Default remotely-accessible administrative account

Once is happenstance; twice is coincidence; three times is enemy action.

[Anonymous Coward]

Default and static password

This is not plain stupidity, it's sabotage. It's like crime with premeditation.

[gollux]

Time for a rename...

Pisco, cause our programmers and security QA are taking one on our clientele.

[RIBrsiq]

It's 2016 and network devices still have telnet...

[Anonymous Coward]

@RIBrsiq - Developers, developers

developers... Sigh!

[Anonymous Coward]

Proof that the NSA...

...loves it's backdoors