VULNERABILITY INTELLIGENCE
CVE-2015-6358
CVSS score5.9 MEDIUM
EPSS probability1.31%
CISA KEVNot currently listed
Published2017-10-12
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913.
Weakness classification
- CWE-295: Improper Certificate Validation
Primary references
- psirt@cisco.com — Issue Tracking, Patch, Vendor Advisory
- psirt@cisco.com — Third Party Advisory, US Government Resource
- psirt@cisco.com — Third Party Advisory, VDB Entry
- psirt@cisco.com — Third Party Advisory, VDB Entry
- psirt@cisco.com — Third Party Advisory, VDB Entry
- psirt@cisco.com — Third Party Advisory, VDB Entry
- psirt@cisco.com — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry