Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Cisco ACE module allows default admin login

CVE-2009-0620 · published 17 years ago
Summary

The Cisco ACE Application Control Engine for Catalyst 6500 switches and 7600 routers is shipped with default usernames and passwords for both the administrator and web management interfaces. Because these credentials are unchanged, a remote attacker could log in and change the device configuration or gain access to the underlying operating system. Change the default passwords to strong, unique ones as soon as the device is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco application_control_engine_module All versions
cpe:2.3:a:cisco:application_control_engine_module:*:*:*:*:*:*:*:*
Original advisory text
Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.1) uses default (1) usernames and (2) passwords for (a) the administrator and (b) web management,...
Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.1) uses default (1) usernames and (2) passwords for (a) the administrator and (b) web management, which makes it easier for remote attackers to perform configuration changes or obtain operating-system access.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-255Credentials Management Errors
Timeline
Published26 Feb 2009
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-0620 · NVD
Track software like this
Free during beta