https://www.bleepingcomputer.com/news/security/cisco-warns-of-backdoor-admin-account-in-smart-licensing-utility/
I am no security expert, but the number of products with high severity vulnerabilities seems concerning to me, especially when “hackers … breach government networks worldwide.”
Is this normal?
You really have to wonder. Customers are just now discovering that a big new feature was launched in the latest 24.3.1 release. It was, at least for a limited number of platforms. But for one of our most important router families, it was in the configuration guides and the release notes, but nope. Not supported. No CLI for it. Zippo.
Very angry customers.
This company isn't going to change until they are forced to.
I always have a laugh when a company who sells security products is breached by something that exploited their own poor security posturing.
you want to bet this some offshore dev with minimal skills, dirt pay, and no incentive to do great work decided it was a good idea to commit credentials to code just to make their dev life easier?
a real devop would have known better.
you never, ever commit credentials to a production code branch, if not any code branch period.
see what offshoring your devs for dirt pay gets you cisco?
you compensate good hard working people, they do good work. not like this guy
Cisco should stop disclosing so much
But don't worry - we're building an inclusive future for all. So inclusive that everyone's invited onto our products because we don't have good security.
Like how does that even get through code review?
The use of white space was to the liking of the reviewer.
Maybe we need to update the Cisco Development Process to include security reviews and milestones??
Oh, wait, we did that about 6 years ago!!
Cisco - the software company 🤣
Like how does that even get through code review?
This is so sad and embarrassing for the entire company. Hard-coded credentials that are baked into the service? Lmao.
CSLU is a joke and nobody uses it. It was built on Windows (what were they smoking) and is used for offline air-gap license registration. Just use the cloud Smart license registration, and avoid all that on-prem CSLU or CSSM garbage unless you have lots of time to burn and a high tolerance for pain. I tell customers to avoid those like the plague. If your switches can reach the Internet directly, then use an HTTPS proxy server for cloud licensing.
This is very bad.
Cisco, get your act together. Nobody wants you to have a Solarwinds-like event.
This happens when company goes down the layoff path. Key contributors put these back doors hack as a way to acknowledge good bye.
Yet another example of quality software development.