CVE-2018-0226

Vulnerability

A vulnerability in the assignment and management of default SSH user accounts for Cisco Aironet 1800, 2800, and 3800 Series Access Points running Cisco Mobility Express Software could allow an authenticated, remote attacker to gain elevated privileges. The issue arises because the Mobility Express controller configures the default SSH user account for an access point to be the first SSH user account created for the controller, if an administrator added user accounts directly instead of using the default configuration or the SSH username creation wizard. This affects Aironet 1800 Series running Mobility Express Software Releases 8.2.121.0 through 8.5.105.0, and Aironet 2800 and 3800 Series running Releases 8.3.102.0 through 8.5.105.0 [1].

Exploitation

An attacker must have valid user credentials for an affected Mobility Express controller. The attacker can then use the default SSH user account (which is the first user account created on the controller) to authenticate to an associated access point via SSH. No additional authentication or user interaction is required beyond possessing the controller credentials [1].

Impact

Successful exploitation allows the attacker to log in to the affected access point with administrative privileges, even though the user account only has read-only privileges on the controller. The attacker can then perform arbitrary administrative actions on the access point, leading to full compromise of the device [1].

Mitigation

Cisco has released free software updates to address this vulnerability. Customers should upgrade to the latest recommended release for their product series, as specified in the Cisco Security Advisory [1]. No workarounds are available; upgrading is the only mitigation.