Cisco Prime Network Registrar Privilege Escalation Vulnerability

A vulnerability in the default configuration of the Cisco Prime Network Registrar (CPNR) virtual appliance (OVA) which could allow an authenticated, local attacker to gain root privileges. The vulnerability is due to an insecure default account present on the affected device. A local attacker could exploit the vulnerability by using the insecure default account to gain additional privileges on the affected device. If successful, the attacker could gain root privileges and possibly compromise the affected device. Cisco has confirmed the vulnerability; however, software updates are not available.  To exploit this vulnerability, an attacker must authenticate to the targeted device with local account access. This access requirement reduces the likelihood of a successful exploit. Cisco  indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Administrators are advised to contact the vendor regarding future updates and releases.

Administrators are advised to allow only trusted users to have network access.

Administrators are advised to allow only privileged users to access administration or management systems.

Administrators are advised to monitor affected systems.