CVE-2015-4216

The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH root authorized key across different customers' installations, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation, aka Bug IDs CSCuu95988, CSCuu95994, and CSCuu96630.

• CWE-200

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironportVendor Advisory
• http://www.securityfocus.com/bid/75417Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1032725Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1032726Third Party Advisory, VDB Entry
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironportVendor Advisory
• http://www.securityfocus.com/bid/75417Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1032725Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1032726Third Party Advisory, VDB Entry

Published

Jun 26, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4210Cross-site scripting (XSS) vulnerability in Cisco WebEx Meet…
• CVE-2015-4211Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows d…
• CVE-2015-4212Cisco WebEx Meeting Center allows remote attackers to obtain…
• CVE-2015-4213Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote auth…
• CVE-2015-4214Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remo…
• CVE-2015-4215Cisco Wireless LAN Controller (WLC) devices with software 7.…
• CVE-2015-4217The remote-support feature on Cisco Web Security Virtual App…
• CVE-2015-4218The web-based user interface in Cisco Jabber through 9.6(3) …
• CVE-2015-4219Cisco Secure Access Control System before 5.4(0.46.2) and 5.…
• CVE-2015-4220Cross-site scripting (XSS) vulnerability in Cisco Unified Pr…
• CVE-2015-4221Cisco Unified Communications Manager IM and Presence Service…
• CVE-2015-4222SQL injection vulnerability in Cisco Unified Communications …