CVE-2019-1723

Cisco Common Services Platform Collector Static Credential Vulnerability

State: Published
Severity: 9.8 Critical
Published: Mar 13, 2019
Updated: Nov 19, 2024
Reserved: Dec 6, 2018

Description

A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. The vulnerability exists because the affected software has a user account with a default, static password. An attacker could exploit this vulnerability by remotely connecting to the affected system using this account. A successful exploit could allow the attacker to log in to the CSPC using the default account. For Cisco CSPC 2.7.x, Cisco fixed this vulnerability in Release 2.7.4.6. For Cisco CSPC 2.8.x, Cisco fixed this vulnerability in Release 2.8.1.2.

Scores

CVSS	Score	Vector	Source
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-264

Affected Products

Product	Versions
Cisco Common Services Platform Collector SoftwareCisco	before 2.7.4.6Affected before 2.8.1.2Affected

References

20190313 Cisco Common Services Platform Collector Static Credential Vulnerabilityvendor-advisory
107405vdb-entry
https://www.info-sec.ca/advisories/Cisco-Collector.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.