← Vulnerability feed

Vulnerability record · CVE-2018-15389 · published 5 October 2018

CVE-2018-15389: Cisco prime collaboration hard-coded credentials vulnerability

Cisco · Prime Collaboration

A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are used during install. The vulnerability is due to a hard-coded password that, in some cases, is not replaced with a unique password. A successful exploit could allow the attacker to access the administrative web interface with administrator-level privileges.

9.8 CVSS 3.0 Critical EPSS 1.5% · top 26.6% CWE-255 · CWE-255CWE-798 · Hard-coded credentials
9.8CVSS 3.0 base score, v2 7.5
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are used during install. The vulnerability is due to a hard-coded password that, in some cases, is not replaced with a unique password. A successful exploit could allow the attacker to access the administrative web interface with administrator-level privileges.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-cpcp-password Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-cpcp-password Vendor Advisory

Track CVE-2018-15389 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-0318Cisco prime collaboration improper authentication vulnerabilityA vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gai…EPSS 3.1%9.8CVE-2018-0319Cisco prime collaboration improper authentication vulnerabilityA vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to …EPSS 3.1%9.8CVE-2018-0320Cisco prime collaboration sql injection vulnerabilityA vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to execute …EPSS 4.0%9.8CVE-2018-0321Cisco prime collaboration improper authentication vulnerabilityA vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the Java Remote Method Invo…EPSS 3.6%8.8CVE-2018-0336Cisco prime collaboration permissions and access controls vulnerabilityA vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to escalate…EPSS 2.4%8.8CVE-2018-0317Cisco prime collaboration permissions and access controls vulnerabilityA vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to escalate their …EPSS 2.6%8.8CVE-2018-0322Cisco prime collaboration permissions and access controls vulnerabilityA vulnerability in the web management interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to modi…EPSS 2.6%8.4CVE-2018-0141Cisco prime collaboration hard-coded credentials vulnerabilityA vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underly…EPSS 0.42%

Source: NIST National Vulnerability Database (record CVE-2018-15389), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.