How to remediate – Allied Telesyn Router/Switch Default Password

1. Introduction

Allied Telesyn Router/Switch Default Password vulnerability allows remote access to network devices using default credentials. This means an attacker could gain full administrative control of your router or switch, potentially compromising the entire network. Affected systems are typically Allied Telesyn routers and switches with unchanged default passwords, impacting confidentiality, integrity, and availability of network data and services.

2. Technical Explanation

The vulnerability stems from using factory-set usernames and passwords on Allied Telesyn devices. An attacker can exploit this by simply attempting to log in with these known credentials. CVE-1999-0508 details this issue. For example, an attacker could use Telnet or SSH to connect to the device’s management interface with default login information. This allows them to modify configurations, intercept traffic, and potentially gain access to other systems on the network.

• Root cause: Use of weak or default credentials.
• Exploit mechanism: An attacker attempts to log in using common default usernames and passwords.
• Scope: Allied Telesyn routers and switches with default credentials enabled.

3. Detection and Assessment

• Quick checks: Attempt Telnet access using default username and password combinations (e.g., admin/admin).
• Scanning: Nessus plugin ID 10897 can detect this vulnerability as an example.
• Logs and evidence: Check device logs for successful logins with default credentials.

telnet <device_ip>

4. Solution / Remediation Steps

To fix the issue, change the default password on affected devices. Follow these precise steps to ensure a secure configuration.

4.1 Preparation

• No services need stopping for this process. A roll back plan involves restoring the backed-up configuration if issues arise.
• This change requires a maintenance window and approval from network administrators.

4.2 Implementation

1. Step 1: Telnet to the device using its IP address.
2. Step 2: Log in with the default credentials (e.g., admin/admin).
3. Step 3: Navigate to the system settings or password change menu. The exact path varies by model, consult your device documentation.
4. Step 4: Change the default password to a strong, unique value.
5. Step 5: Save the configuration and log out.

4.3 Config or Code Example

Before

Username: admin
Password: admin

After

Username: admin
Password: <strong_new_password>

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability type include least privilege and secure defaults. Least privilege limits the impact if an account is compromised. Secure defaults ensure systems start with strong configurations.

• Practice 1: Implement least privilege by creating separate accounts for different administrative tasks.
• Practice 2: Enforce strong password policies, including complexity requirements and regular rotation.

4.5 Automation (Optional)

Automation is not generally suitable for this specific vulnerability due to the need for manual interaction with each device’s configuration interface.

5. Verification / Validation

• Post-fix check: Attempt Telnet access using default username and password – it should fail.
• Re-test: Repeat the initial detection steps (attempting default credentials) to confirm they no longer work.
• Smoke test: Verify basic network connectivity by pinging a known host on the network.

telnet <device_ip> 

6. Preventive Measures and Monitoring

Update security baselines to include strong password requirements for network devices. Implement regular patch cycles and configuration reviews to identify and address default credentials. For example, use a CIS control checklist during audits.

• Baselines: Update your network device baseline to require unique passwords on all systems.
• Pipelines: Include checks in deployment pipelines to ensure new devices are not shipped with default credentials.
• Asset and patch process: Review device configurations quarterly for unchanged default passwords.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Incorrect password entry may result in account lockout.
• Roll back: Restore the previously backed up device configuration via TFTP or other supported method.

8. References and Resources

• Vendor advisory or bulletin: http://www.phenoelit-us.org/dpl/dpl.html
• NVD or CVE entry: CVE-1999-0508