Cisco switches with SNMP vulnerability

A firmware flaw in Cisco's Industrial Ethernet 3000 switches causes the community strings chosen by the admin to be overwritten after every reboot. This allows attackers to read and edit the configuration parameters in a local network via the "public" and "private" standard strings – without further access restrictions. By default, SNMP is disabled on the devices.

Firmware versions 12.2 from 12.2(52)SE are affected. Cisco offers a workaround which initially removes the standard strings immediately and, as a second step, removes them from the configuration after every system start. The vendor says that firmware version 12.2(55)SE, in which the flaw has been fixed, will be released in August.

(crve)