Hirschmann “Classic Platform” switches reveal administrator password in SNMP community string by default
Original Release date: 16 Feb 2016 | Last revised: 16 Feb 2016

Overview
Hirschmann “Classic Platform” switches contain a password sync feature that syncs the switch administrator password with the SNMP community password, exposing the administrator password to attackers on the local network.

Description

CWE-257: Storing Passwords in a Recoverable Format
For all Hirschmann (part of Belden) “Classic Platform” switches (which includes the MACH series workgroup switches, among others), by default, the switch administrator password is used to construct an SNMP community string that allows remote management of some switch configuration.

Attackers on the local network with the ability to sniff network traffic may be able to recover the administrator password from the community string.Belden has released security advisory BSECV-2016-2 which describes this issue in more detail.

Impact

An attacker on the local network may learn the switch administrator password from the SNMP community string, which is sent over the network in plaintext in SNMPv1 and SNMPv2.

Solution

Disable the SNMP Password Sync feature and use SNMPv3Affected users may disable the password sync feature on their devices.

For more information, please see Belden security advisory BSECV-2016-2. Users are also encouraged to use SNMPv3, which supports encrypted network traffic.According to Hirschmann, the password sync feature was enabled by default to aid in network setup during the transition from SNMPv1/v2 to SNMPv3. Hirschmann has committed to disabling the password sync feature by default in future devices and firmware now that SNMPv3 is the default on their products.

Vendor Information (Learn More)
Vendor
Status
Date Notified
Date Updated
Belden
Affected

28 Jan 2016
If you are a vendor and your product is affected, let us know.
CVSS Metrics (Learn More)
Group
Score
Vector
Base
8.3
AV:A/AC:L/Au:N/C:C/I:C/A:C
Temporal
6.9
E:F/RL:OF/RC:C
Environmental
5.2
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit
Thanks to Mark Jaques for reporting this vulnerability.
This document was written by Garret Wassermann.

Other Information
CVE IDs: Unknown
Date Public: 16 Feb 2016
Date First Published: 16 Feb 2016
Date Last Updated: 16 Feb 2016
Document Revision: 58

Feedback
If you have feedback, comments, or additional information about this vulnerability, please send us email.