Cisco Umbrella Virtual Appliance - Hardcoded Credentials (CVE-2017-12350) Overview "As the industryas first Secure Internet Gateway in the cloud, Cisco Umbrella provides the first line of defense against threats on the internet. Because Umbrella is delivered from the cloud, it is the easiest way to protect all of your users in minutes." (https://umbrella.cisco.com/) Issue The Cisco Umbrella virtual appliance (version 2.1.0 and below) contains undocumented hardcoded credentials which could allow an attacker able to access the hypervisor console, persistent and unrestricted access to the virtual appliance. Impact An attacker able to access the hypervisor console could use the hardcoded credentials on the virtual appliance, elevate their privileges to root from a trusted system user and perform a wide range of attacks. Timeline October 10, 2017 - Notified Cisco via psirt@cisco.com October 11, 2017 - Cisco assigned a case number November 8, 2017 - Cisco advised that the issue has been resolved and that a security advisory will be published on November 15, 2017 November 15, 2017 - Cisco published a security advisory to document this issue Solution Upgrade to virtual appliance 2.1.2 or later https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-uva CVE-ID: CVE-2017-12350 Questions? https://www.info-sec.ca/contact.html