Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability

Vulnerability

The vulnerability resides in the Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data. A documented default account named scpuser exists in these products with an undocumented default password, and the default password is not enforced to be changed during installation. This allows an unauthenticated, remote attacker to log in to the CLI of an affected system using the scpuser account. The affected versions are those prior to the fixed releases provided by Cisco [1].

Exploitation

An attacker can exploit this vulnerability by using the scpuser account with its default credentials to log in to the CLI of an affected system remotely. No authentication or prior access is required. The attacker only needs network access to the target system's CLI interface. Once logged in, the attacker can execute commands with the privileges of the scpuser account [1].

Impact

A successful exploit grants the attacker the ability to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database, potentially leading to complete compromise of the affected system's data and configuration. The impact is severe, as it allows unauthorized access and control over critical infrastructure management components [1].

Mitigation

Cisco has released free software updates to address this vulnerability. Customers are advised to upgrade to the fixed versions as soon as possible. The fixed releases are available through the Cisco Software Center. For customers without service contracts, contact the Cisco TAC. There are no workarounds listed; changing the default password manually is recommended but not enforced. The vulnerability is not listed on the CISA KEV as of the publication date [1].