Cisco Prime Network Registrar Privilege Escalation Vulnerability

A vulnerability in the default configuration of the Cisco Prime Network Registrar (CPNR) virtual appliance (OVA) which could allow an authenticated, local attacker to gain root privileges.

The vulnerability is due to an insecure default account present on the affected device. A local attacker could exploit the vulnerability by using the insecure default account to gain additional privileges on the affected device. If successful, the attacker could gain root privileges and possibly compromise the affected device.

Cisco has confirmed the vulnerability; however, software updates are not available.

To exploit this vulnerability, an attacker must authenticate to the targeted device with local account access. This access requirement reduces the likelihood of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.