Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Cisco virtual security appliances allow remote login with shared key

CVE-2015-4216 · published 11 years ago
Summary

The Web Security, Email Security, and Security Management virtual appliances from Cisco use the same default SSH key for remote support on installations made before June 2015. This shared key lets an attacker who obtains it for one customer log into another customer's device without proper authentication. Update the appliances to the latest version or replace the default key to secure remote access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco content_security_management_virtual_appliance 8.4.0.0150
9.0.0.087
cpe:2.3:a:cisco:content_security_management_virtual_appliance:8.4.0.0150:*:*:*:*:*:*:*
cisco email_security_virtual_appliance 8.0.0
8.5.6
8.5.7
9.0.0
cpe:2.3:a:cisco:email_security_virtual_appliance:8.0.0:*:*:*:*:*:*:*
cisco web_security_virtual_appliance 7.7.5
8.0.5
8.5.0
8.5.1
8.6.0
8.7.0
cpe:2.3:a:cisco:web_security_virtual_appliance:7.7.5:*:*:*:*:*:*:*
Original advisory text
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses t...
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published26 Jun 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-4216 · NVD
Track software like this
Free during beta