Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Nexus 9000 Switches Allow SSH As Root

nvd.nist.gov

Post reply on HN
Print view View original

51–60 of 113 posts

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#51

Post by fulafel »

tptacek wrote: post #3

This is a pretty egregiously editorialized title; what we know is that there's apparently an SSH keypair authorized on these devices, for which the private key is available on the device. That's a terrible, ugly vulnerability, but it's as likely due to stupidity as to malice. The right title is something like: CVS-2019-1804: Cisco Nexus 9000 Switches Allow SSH As Root.

> Allow SSH As Root

That sounds like they just erroneously left AllowRootLogins yes in the ssd_config, which would not be a critical vulnerability.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#52

Post by walrus01 »

sky_nox wrote: post #2

If you have the Cisco 9000 Series, patch them now! This SSH backdoor allows an unauthenticated, remote attacker to login as root.

Also you should have ACLs in place and VLAN segmentation (assuming their use as pure layer 2 devices) so that only certain authorized sections of the network are even able to reach things like the management ssh and SNMP daemons.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#53

Post by wmf »

fulafel wrote: post #49

What product segment is this, what kind of organizations are likely have them? Also, link to Cisco's own advisory: https://tools.cisco.com/security/center/content/CiscoSecurit...

It's a switch used in enterprise data centers. It's pretty critical because servers plug directly into it.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#54

Post by blotter_paper »

gwright wrote: post #38
tinus_hn wrote: post #14

Earlier quoted context omitted.

It is impossible to know the motivation of the person who put this here but these constructs have no place in firmware for critical devices and Cisco should have known that for a long time already. Either they truly are idiots or this is malicious.

More likely they are just imperfect humans.

That's a bit vague; imperfect humans are both malicious and incompetent, often at the same time.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#55

Post by wmf »

userbinator wrote: post #44

I don't own nor have I read the manual of one of these, and there's not much in the way of details on that page, but isn't this more like "use the factory-supplied default key to get in for the first time, then change it to your own"?

People are calling it a backdoor because presumably it was not documented anywhere.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#56

Post by wmf »

madez wrote: post #48

I surely can't be the only one who sees open down to the hardware replacements as the only solution to this type of problems.

For most enterprise IT products there is no "open down to the hardware" replacement and there never will be because there isn't a business model to create it.

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#59

Post by rakkhi »

sky_nox wrote: post #2

If you have the Cisco 9000 Series, patch them now! This SSH backdoor allows an unauthenticated, remote attacker to login as root.

Without wanting to start a political flame war it would be great if there was consistency to how we in the tech community and the media treat these types of vulnerabilities. When Huawei have these sorts of bugs they are reported as backdoors. Bugs happen in software be nice if put the nationalism aside and reported it consistently as bugs or vulnerabilities

Re: Cisco Nexus 9000 Switches Allow SSH As Root

#60

Post by rando444 »

thickice wrote: post #58

can someone help me understand this better.. Did Cisco leave a user public key in the switch and the private key has leaked ? To exploit this vulnerability attacker has to get hold of that private key ?

The keypair is essentially some default known value.

You shouldn't be able to use this to connect at all, but apparently works over IPv6.

So you'd have to have the private key, as well as knowing the IPv6 address of the device you're connecting to, and that device would have to have a route to the internet or a location you could connect to it from.

Post reply on HN