Highest Severity Cisco Flaw

by Artie Kaye

A zero-day has been found in Cisco IOS XE when it is exposed to the internet.  An unauthenticated user could leverage it to create a top level account and take over the device.  The CVE rating for this exploit is 10.  Over 40,000 devices have been found to have been compromised thus far.  At the time of writing, Cisco has not developed a patch but is offering mitigation advice.  Disable the HTTP server feature if it is not in use, and if it is in use, restrict user access to those services.  For more technical information, please refer to the security advisory from Cisco linked below.

---

Admin Password Strength (or Lack Thereof…)

by Artie Kaye

Researchers at Outpost24 analyzed a pool of approximately 1.8 million samples and have compiled a list of 20 passwords most commonly used by network administrators.  Some of those listed are also device or account default passwords, indicating that no effort was given to improving security for the account or device.  Strong passwords help protect systems and files from threats.  The 20 most common passwords are as follows:

admin
123456
12345678
1234
Password
123
12345
admin123
123456789
adminisp
demo
root
123123
admin@123
123456aA@
01031974
Admin@123
111111
admin1234
admin1

---