1. Introduction
The Cisco WAAS Mobile Server Web Administration Default Credentials vulnerability allows remote attackers to gain access to a web application interface using pre-set login details. This poses a risk to the confidentiality, integrity and availability of systems running this service. Affected systems are typically Cisco Wide Area Application Services (WAAS) mobile servers with exposed web administration interfaces. A successful exploit could allow an attacker to fully compromise the device.
2. Technical Explanation
The vulnerability exists because the web administration interface for Cisco WAAS Mobile Server uses a default username and password (‘admin / default’). This allows attackers to bypass normal authentication mechanisms. There is no CVE associated with this specific issue, but it represents a common misconfiguration. An attacker could simply attempt to log in using these credentials from any network location where the web interface is accessible. Affected versions include those shipped with default configurations.
- Root cause: Use of hardcoded default credentials.
- Exploit mechanism: An attacker attempts login with ‘admin’ as username and ‘default’ as password via the web administration interface.
- Scope: Cisco WAAS Mobile Server, all versions using default credentials.
3. Detection and Assessment
You can confirm if a system is vulnerable by checking the version of the WAAS Mobile server and verifying whether the default credentials are still in use. A thorough method involves attempting to log in with the default credentials.
- Quick checks: Access the web administration interface and check for login prompts.
- Scanning: Nessus plugin ID 8958349 can identify this vulnerability as an example.
- Logs and evidence: Check server logs for failed login attempts using the ‘admin’ username, which may indicate scanning activity.
4. Solution / Remediation Steps
The solution involves changing the default login credentials for the Cisco WAAS Mobile Server Web Administration Interface. These steps are small and testable.
4.1 Preparation
- Dependencies: Access to the web administration interface with administrative privileges. A roll back plan involves restoring the backed-up configuration.
- Change window needs: This change should be performed during a scheduled maintenance window. Approval from system owners may be needed.
4.2 Implementation
- Step 1: Log in to the Cisco WAAS Mobile Server web administration interface using the default credentials (‘admin / default’).
- Step 2: Navigate to System > Administration > Security Settings (the exact path may vary slightly depending on firmware version).
- Step 3: Change the ‘Admin Password’ field. Choose a strong, unique password.
- Step 4: Save the changes and log out of the interface. Log back in using the new credentials to verify.
4.3 Config or Code Example
Before
Admin Password: default
After
Admin Password: [Strong, unique password]
4.4 Security Practices Relevant to This Vulnerability
Several security practices can help prevent this type of issue. Least privilege reduces impact if exploited. Safe defaults ensure systems start in a more secure configuration. Regular patch cadence ensures known vulnerabilities are addressed promptly.
- Practice 1: Implement least privilege access controls to limit the potential damage from compromised accounts.
- Practice 2: Enforce safe default configurations for all new deployments, including strong passwords and disabled unnecessary services.
4.5 Automation (Optional)
Automation is not typically suitable for this specific vulnerability due to the need for manual password changes via a web interface.
5. Verification / Validation
- Post-fix check: Attempt to log in using ‘admin / default’. The login should fail.
- Re-test: Repeat the initial detection method (attempting to log in with default credentials) to confirm failure.
- Monitoring: Monitor server logs for failed login attempts using ‘admin’ as a username, which could indicate ongoing scanning activity.
Login attempt failed for user 'admin'.
6. Preventive Measures and Monitoring
- Baselines: Update your security baseline to require strong passwords for all system accounts, including those on Cisco WAAS Mobile Servers.
- Asset and patch process: Implement a regular patch or config review cycle to ensure systems are updated with the latest security fixes and configurations.
7. Risks, Side Effects, and Roll Back
Changing the password may temporarily disrupt access if the new credentials are forgotten. Ensure you have documented the new password securely. To roll back, restore the backed-up configuration.
- Risk or side effect 1: Loss of access if the new password is lost or forgotten. Mitigation: Document the new password securely and consider a password reset process.
- Roll back: Restore the previously backed up configuration file.
8. References and Resources
- Vendor advisory or bulletin: http://www.nessus.org/u?f8958349