Title

The Unified Communications Endpoint must not be configured with any vendor default accounts, PINs, or passwords to access configuration settings. (Cat II impact)

Discussion

Many Unified Communications Endpoints can set or display configuration settings in the instrument itself. This presents a risk if a user obtains information such as the IP addresses and URLs of system components. This obtained information could be used to facilitate an attack on the system. Therefore, these devices should be considered a target to be defended against individuals that would collect voice network information for illicit purposes. To mitigate information gathering by the adversaries, measures must be taken to protect this information.

Check Content

Verify the Unified Communications Endpoint does not use the default PIN or password to access configuration settings. If the Unified Communications Endpoint uses the default PIN or password to access configuration settings, this is a finding.

Fix Text

Configure the Unified Communications Endpoint to not use the default PIN or password to access configuration settings.

Additional Identifiers

Rule ID: SRG-NET-000015-VVEP-00100_rule

Vulnerability ID: SRG-NET-000015-VVEP-00100

Group Title: SRG-NET-000015-VVEP-00100

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.