Cisco scores a perfect 10 - sadly for a critical flaw in its comms platform

If you're running the Engineering-Special (ES) builds of Cisco Unified Communications Manager or its Session Management Edition, you need to apply Cisco's urgent patch after someone at Switchzilla made a big mistake. Cisco Unified Communications Manager (CM) consolidates IP telephony, high-definition video, unified messaging, …

[Jou (Mxyzptlk)]

Does Cisco use Ciso gear inside?

Or do they mix vendors for themselves for security reasons?

[MiguelC]

Re: Does Cisco use Ciso gear inside?

For best security they wouldn't use Cisco equipment at all

May I recommend Huawei? It seems the TLAs have trouble getting into those...

[Anonymous Coward]

Re: Does Cisco use Ciso gear inside?

Depends if you want to sell to the US or not. If you do want to sell to the US, you can't have Huawei in your business or your supply chain (you're required to self-certify this to pass compliance).

[druck]

Re: Does Cisco use Ciso gear inside?

No, as UKCSG found, there is no evidence of intentional backdoors, as they are so full of unintentional holes anyone can get in anyway.

[Anonymous Coward]

Lack of security in development… <sigh>

[Mishak]

Development Accounts

Maybe their setup is more complicated than what I'm used to, but I use "Release" and "Development" builds of my projects to make sure "hacks to make development easy" don't compromise the product!

[Jou (Mxyzptlk)]

Re: Development Accounts

They have to earn money, not make quality. This is not the cisco from the 1980's or early 90's.

[Charlie Clark]

Re: Development Accounts

Agreed. For years Cisco has been doing what the rest of US industry does and that's buy up anything that looks like it might be competition, migrate customer accounts and essentially freeze any development.

[pc-fluesterer.info]

"Mistake"?

"forget" hardcoded credentials is a mistake?

Or is it intention, perhaps because Uncle Sam wanted this backdoor?

Anyway this is unbelievable and unforgivable.

[Anonymous Coward]

Hardcoded credentials, even in a development branch, is not a mistake. It's malicious. Anyone doing that for cisco should be fired along with everyone who pushed this through to production without noticing.

Seeing as that's allowed to happen, along with all the other issues of late, I really don't think cisco kit can be seriously considered for any project. How are they still in business?

[Anonymous Coward]

hopefully the two users of CM will take note

[Excused Boots]

Yes, a percent 10,

We’re number one, we’re number one.

Ah, wait hang on a minute.......

[Anonymous Coward]

Spooks?

Oh, so they found the spooks back door then.

Anonymous because...they're watching of course!

[IGotOut]

So...

Huawei "may" have hidden security credentials. Bad. Ban them.

Cisco HAS hidden backdoor. Good! USA! USA! USA!