Cisco Umbrella Virtual Appliance - Hardcoded Credentials (CVE-2017-12350)


"As the industry’s first Secure Internet Gateway in the cloud, Cisco Umbrella provides the first line of defense against threats on the internet. Because Umbrella is delivered from the cloud, it is the easiest way to protect all of your users in minutes."



The Cisco Umbrella virtual appliance (version 2.1.0 and below) contains undocumented hardcoded credentials which could allow an attacker able to access the hypervisor console, persistent and unrestricted access to the virtual appliance.


An attacker able to access the hypervisor console could use the hardcoded credentials on the virtual appliance, elevate their privileges to root from a trusted system user and perform a wide range of attacks.


October 10, 2017 - Notified Cisco via
October 11, 2017 - Cisco assigned a case number
November 8, 2017 - Cisco advised that the issue has been resolved and that a security advisory will be published on November 15, 2017
November 15, 2017 - Cisco published a security advisory to document this issue


Upgrade to virtual appliance 2.1.2 or later




Contact Information