Title

The network device must require authentication prior to establishing a management connection for administrative access. (Cat I impact)

Discussion

Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.

Check Content

Review the network device configuration to verify all management connections for administrative access require authentication. If authentication isn't configured for management access, this is a finding.

Fix Text

Configure authentication for all management connections.

Additional Identifiers

Rule ID: SV-3175r5_rule

Vulnerability ID: V-3175

Group Title: Management connections must require passwords.

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.