What’s Vulnerable › Vulnerabilities

CVE-2015-4216

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-06-26 · updated 2026-06-17
• Weakness: CWE-200

Description

The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.

Affected products

• Cisco Content Security Management Virtual Appliance: 8.4.0.0150, 9.0.0.087
• Cisco Email Security Virtual Appliance: 8.0.0, 8.5.6, 8.5.7, 9.0.0
• Cisco Web Security Virtual Appliance: 7.7.5, 8.0.5, 8.5.0, 8.5.1, 8.6.0, 8.7.0

References

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport
• http://www.securityfocus.com/bid/75417
• http://www.securitytracker.com/id/1032725
• http://www.securitytracker.com/id/1032726
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport
• http://www.securityfocus.com/bid/75417
• http://www.securitytracker.com/id/1032725
• http://www.securitytracker.com/id/1032726

Get alerted when CVE-2015-4216 or the next vulnerability affects your stack