CVE-2015-4217 - CVE House

Back to Database

Status published Medium CVE-2015-4217

The remote-support feature on Cisco Web Security Virtual Appliance (WSAv),...

4.3 CVSS

Vulnerability Description

The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-4217

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from cisco

View All →

OpenH264 Decoding Functions Heap Overflow Vulnerability

Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

The TrustZone implementation in certain Broadcom MediaxChange firmware could allow...

A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0...

A denial-of-service issue in Cisco Unified IP Conference Station 7937G...

Affected Vendor

cisco

View all reports →

Affected Software

content security management virtual appliance, email security virtual appliance, web security virtual appliance

Vulnerable Versions:

8.4.0.0150, 9.0.0.087, 8.0.0, 8.5.6, 8.5.7, 9.0.0, 7.7.5, 8.0.5, 8.5.0, 8.5.1, 8.6.0, 8.7.0

Timeline

Official Publish: June 26th, 2015

Last Modified: August 6th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.