CVE-2015-4217
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual...
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
Exploit likelihood
What each source reports
NVD Score used
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
- Record
CVE-2015-4217- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200, CWE-310
- Updated
- 2026-11-02
CVE List No score
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
- Record
CVE-2015-4217- Updated
- 2026-11-02
EUVDEUVD-2015-4240 No score
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
- Record
EUVD-2015-4240- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rwpv-8h6r-wrrr No score
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual...
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
- Record
GHSA-rwpv-8h6r-wrrr- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-4217 is a medium vulnerability (CVSS 4.3) in Cisco Email Security Virtual Appliance, published June 26, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.23%, the 82nd percentile. No source names a fixed version.
References
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport
securitytracker.com/id/1032725
securityfocus.com/bid/75418
nvd.nist.gov/vuln/detail/CVE-2015-4217
github.com/advisories/GHSA-rwpv-8h6r-wrrr