CVE-2015-6358
Description
Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco rv320_firmware | v ≤ 1.3.1.10 | — |
| cisco rv325_firmware | v ≤ 1.3.1.10 | — |
| cisco rvs4000_firmware | v ≤ 2.0.3.4 | — |
| cisco wrv210_firmware | v ≤ 2.0.1.5 | — |
| cisco wap4410n_firmware | v ≤ 2.0.7.8 | — |
| cisco wrv200_firmware | 1.0.39 | — |
| cisco wrvs4400n_firmware | v ≤ 2.0.2.2 | — |
| cisco wap200_firmware | v ≤ 2.0.6.0 | — |
| cisco wvc2300_firmware | v ≤ 1.1.2.6 | — |
| cisco pvc2300_firmware | v ≤ 1.1.2.6 | — |
| cisco srw224p_firmware | v ≤ 2.0.2.4 | — |
| cisco wet200_firmware | v ≤ 2.0.8.0 | — |
| cisco wap2000_firmware | v ≤ 2.0.8.0 | — |
| cisco wap4400n_firmware | v ≤ - | — |
| cisco rv120w_firmware | v ≤ 1.0.5.9 | — |
| cisco rv180_firmware | v ≤ 1.0.5.4 | — |
| cisco rv180w_firmware | v ≤ 1.0.5.4 | — |
| cisco rv315w_firmware | v ≤ 1.01.03 | — |
| cisco srp520_firmware | v ≤ 1.01.29 | — |
| cisco srp520-u_firmware | v ≤ 1.2.6 | — |
| cisco wrp500_firmware | v ≤ 1.0.1.002 | — |
| cisco spa400_firmware | v ≤ 1.1.2.2 | — |
| cisco rtp300_firmware | v ≤ 3.1.24 | — |
| cisco rv220w_firmware | v ≤ 1.0.4.17 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.