CVE-2010-0599

Cisco Mediator Framework <=3.0.9 - Unauthenticated Credential Exposure via XML RPC

Title source: llm

Description

Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng, 2.2 before 2.2.1.dev.1, and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 does not encrypt XML RPC sessions from operator workstations, which allows remote attackers to discover Administrator credentials by sniffing the network, aka Bug ID CSCtb83505.

References (5)

Core 5

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1024027

Patch, Vendor Advisory vendor-advisory x_refsource_cisco

http://www.cisco.com/en/US/products/products_security_advisory09186a0080b2c518.shtml

Various Sources x_refsource_misc

http://www.us-cert.gov/control_systems/pdf/ICSA-10-147-01_Cisco_Network_Building_Mediator.pdf

US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/757804

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/39904

Scores

EPSS 0.0322

EPSS Percentile 86.9%

Details

CWE

CWE-255

Status published

Products (3)

cisco/mediator_framework 1.5.1

cisco/mediator_framework 2.2

cisco/mediator_framework 3.0.8

Published May 27, 2010

Tracked Since Feb 18, 2026