Long term, brute force password guessing can be performed without being noticed. When the correct password is guessed, it can be used to view or modify router configuration. This may be particularly dangerous in installations where multiple routers have the same password. Every affected device must be powered off and back on in order to restore its normal functionality. The following table summarizes the CBOS software releases affected by the defects described in this notice and scheduled dates on which the earliest corresponding fixed releases will be available.
Dates are tentative and subject to change.
All dates are estimated and subject to change. Obtaining Fixed Software Cisco is offering free software upgrades to eliminate this vulnerability for all affected customers. Customers with contracts should obtain upgraded software through their regular update channels. Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. There are two workarounds for this vulnerability.