How to remediate – IBM Network Security Protection XGS Default Credentials

1. Introduction

The IBM Network Security Protection XGS device is vulnerable due to using default credentials for the ‘admin’ account. This allows an attacker to gain unauthorised administrative access to the device, potentially compromising network security and data confidentiality. Systems running the affected web application are at risk. A successful attack could lead to full system compromise, including data theft, modification of configurations, and denial of service.

2. Technical Explanation

Nessus was able to log in to the IBM Network Security Protection XGS device using a known default username and password combination. This is due to an insecure default configuration where strong passwords are not enforced during initial setup. An attacker could remotely exploit this by attempting to login with these credentials, gaining full administrative control of the device.

• Root cause: The remote IBM Network Security Protection XGS device uses a known set of default credentials for the ‘admin’ account.
• Exploit mechanism: An attacker attempts to log in using the default username and password combination, gaining access to the web application interface.
• Scope: Affected systems are those running the IBM Network Security Protection XGS with default credentials enabled.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking for the presence of default credentials or attempting to log in using them.

• Quick checks: Access the web application login page and check if it prompts for default credentials.
• Scanning: Nessus vulnerability ID 168297 can be used to detect this issue. This is an example only, other scanners may also provide detection capabilities.
• Logs and evidence: Check system logs for successful logins using the default ‘admin’ account.

# No command available as login must be attempted via web interface

4. Solution / Remediation Steps

The following steps provide a precise method to fix this issue.

4.1 Preparation

• A change window may be needed depending on your organisation’s policies, and approval should be obtained from relevant stakeholders.

4.2 Implementation

1. Step 1: Log in to the IBM Network Security Protection XGS web application using the default credentials.
2. Step 2: Navigate to System > Administration > Users.
3. Step 3: Select the ‘admin’ account and click ‘Edit’.
4. Step 4: Change the password for the ‘admin’ account to a strong, unique password.
5. Step 5: Save the changes.

4.3 Config or Code Example

Before

# Default credentials are used for the admin account. No password set by user.

After

# A strong, unique password has been configured for the admin account.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue.

• Practice 1: Enforce strong passwords and regular password changes to reduce the risk of compromise.
• Practice 2: Implement least privilege principles, limiting access rights based on user roles.

4.5 Automation (Optional)

Automation is not recommended for this vulnerability due to the potential for lockout or misconfiguration. Manual password changes are preferred.

# No automation script provided as it carries a high risk of disruption.

5. Verification / Validation

• Post-fix check: Attempt to login using the default username and password combination; access should be denied.
• Re-test: Re-run Nessus vulnerability ID 168297, which should no longer report the issue.
• Smoke test: Verify that you can log in with the new credentials and access key system functions.
• Monitoring: Monitor logs for failed login attempts using default credentials as an indicator of ongoing attacks. This is an example only.

# Attempt to login via web interface - should fail after password change.

6. Preventive Measures and Monitoring

Several measures can help prevent similar vulnerabilities in the future.

• Baselines: Update security baselines or policies to require strong passwords for all accounts, including default accounts.
• Pipelines: Implement configuration management tools to enforce password complexity rules and regularly audit configurations.
• Asset and patch process: Establish a regular review cycle for device configurations and ensure timely patching of security vulnerabilities.

7. Risks, Side Effects, and Roll Back

Changing the password could result in temporary service disruption if the new credentials are forgotten or incorrectly entered.

• Roll back: Restore the device configuration from a backup taken prior to making any changes.

8. References and Resources

The following resources provide additional information about this vulnerability.

• Vendor advisory or bulletin: IBM Security Bulletin
• NVD or CVE entry: CVE-2023-28678
• Product or platform documentation relevant to the fix: IBM Network Security Protection XGS User Configuration