CVE-2015-4216

CVE-2015-4216 describes a critical vulnerability in Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices. The remote-support feature in these appliances utilized a single, default SSH root authorized key across all customer installations. This design flaw allows remote attackers to bypass authentication by reusing a private key obtained from any other affected installation. The vulnerability has a CVSS score of 5.0, indicating a medium severity. Its attack vector is network-based with low attack complexity, requiring no authentication, and potentially leading to partial confidentiality impact. While the EPSS score is low, suggesting a minimal likelihood of exploitation, the FAUCET Risk Score is 17/100. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Despite this, the vulnerability has garnered some community attention, with mentions on Reddit and coverage in SecurityWeek, highlighting the risk posed by default SSH keys.