Some room systems and personal units enable root access by default
Cisco has issued a security advisory on some of its recently acquired Tandberg video products. In the advisory, Cisco says the Tandberg C series endpoints and E/EX personal video units running software versions prior to TC 4.0.0 enable root administrator access through a default password.
An attacker could use this to modify the application configuration or operating system settings, Cisco says. The default password setting, however, can be changed or disabled through a configuration command – it does not require a software upgrade, the advisory states.
The C series endpoints are typically deployed as multipurpose room systems and the E/EX personal video units are desktop devices. These devices contain a root user that is enabled for advanced
debugging that is unnecessary during normal operations, but enabled by default in software versions prior to TC 4.0.0 – it does not set a password for the root user.
This may allow an unauthorized user to gain complete administrative control of the device, in addition to changing an application configuration or operating system setting.
When a device is upgraded to TC 4.0.0 the root user is disabled. But again, a software upgrade is not required – there are also workarounds, described in the advisory, to mitigate the problem.
The vulnerability was discussed in the article “Hacking and Securing the Tandberg C20” published in Volume 27, Number 3 of 2600 Magazine.
More from Cisco Subnet:
Cisco’s LineSider buy big for IT prize
Verizon 2010 Data Breach Report Is Eye Opening
What’s at the core of Cisco’s plight?
Cisco sends up a warning flare
TSHOOT Practice Questions – The Answers!
Cisco’s 3QCY10 Global Threat Report Results
The Smart-Fat and Smart-Thin Edge of the Network
Upgrade Your Cisco Cert to an HP Cert
Win a five-book library from Cisco Press
Follow all Cisco Subnet bloggers on Twitter.Jim Duffy on TwitterFollow
