icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons icons_061

Cisco 'tech-support' Anonymous User Debugging Information Disclosure

Low

Synopsis

The remote host is vulnerable to a flaw that allows attackers to retrieve sensitive files or data.

Description

Cisco routers and switches ship with a default web interface that allows remote administrators to view the entire configuration via the web. Unfortunately, many of these devices are not password protected and allow anonymous users to download critical router/switch configuration information. An attacker can download the Cisco configuration file by browsing to /exec/show/tech-support/cr

Solution

Enable passwords for the Cisco IOS web server.