Cisco admins gear up for a late night – hardcoded password in wireless points nuked Cisco sysadmins have a busy day ahead of them, with vulnerabilities announced in wireless LAN controllers, the Cisco Identity Services Engine, and Aironet access points. The Aironet 1800 series flaw, CVE-2015-6336, is that old favorite: a hardcoded static password granting access to the device. Luckily, the account with the …
The wireless LAN controller vulnerability is apparently exploited through the webauth feature, which is mostly used for guest access. So an external attacker can probably find somewhere comfortable to sit while they root the controller. This would usually be an "anchor" controller out on a DMZ, which limits some of the impact. However, there are likely to be some that use this function for internal access.
Hardly a late night. Took about 15 mins to update software on all controllers. Set them off pre-downloading image to APs, scheduled reload of controllers for overnight. Came into work this morning checked controllers, all good with new code version. Biggest amount of time expended was waiting for software to download from cisco.com
As we keep the software on our controllers up to date this is something which is done several times a year and isn't an extra ordinary task.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
