Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2018-0468: Cisco Energy Management Suite local database default password allows data change
CVE-2018-0468 · published 7 years ago
Summary
The Cisco Energy Management Suite installs a PostgreSQL database with its default login details unchanged. Anyone who can log onto the server can connect to the database and view or modify confidential information. Change the database password manually on existing installations and ensure new installs use a unique password.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | energy_management_suite |
5.2 cpe:2.3:a:cisco:energy_management_suite:5.2:*:*:*:*:*:*:* |
Original advisory text
A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential ...
A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default access credentials. An attacker could exploit this vulnerability by logging in to the machine where CEMS is installed and establishing a local connection to the database. The fix for this vulnerability randomizes the database access password in new installations; however, the fix will not change the password for existing installations. Users are required to manually change the password, as documented in the Workarounds section of this advisory. There are workarounds that address this vulnerability.
References
- http://www.securityfocus.com/bid/106124 Third Party Advisory VDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2... Vendor Advisory
- https://www.tenable.com/security/research/tra-2018-42 Broken Link Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published4 Dec 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-0468 · NVD
Track software like this
Free during beta