This script is Copyright (C) 2013-2015 Tenable Network Security, Inc.
The remote database server can be accessed without a password.
The version of Cisco Security Manager (CSM) running on the remote host
is using a vulnerable version of Cisco IPS Event Viewer (IEV). IEV is
included with CSM by default. When the IEV server is accessed remotely,
it opens up TCP ports that allow access to the MySQL or IEV server
without authentication. A remote, unauthenticated attacker could
exploit this to gain root access to the IEV database and server.
Note that the MySQL service uses SSL/TLS and is not directly accessible
using the official MySQL client.
See also :
Upgrade to one of the non-vulnerable versions of Cisco Security Manager
listed in Cisco Security Advisory cisco-sa-20090121-csm.
Risk factor :
Medium / CVSS Base Score : 6.8
CVSS Temporal Score : 5.6
Public Exploit Available : true
Nessus Plugin ID: 69303 ()
Bugtraq ID: 33381
CVE ID: CVE-2008-3820
Upgrade to Nessus Professional today!
Start your free Nessus Cloud trial now!
Begin Free Trial
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.