A bug in Cisco Systems networking software can potentially give hackers passwords for access to a network's routers.
The bug is present in "the majority of Cisco's traditional router products", though not most of its LAN or WAN products, said John Bashinski, a customer engineer with Cisco's product security incident response team.
If a hacker gets to the login prompt of affected routers and types in certain characters, they may be rewarded with fragments of what the last person who logged in typed, according to Bashinski.
"It's not like you can get a transcript of what they typed . . . but you can get pieces of lines," Bashinski said. "Our biggest concern is that a fragment could contain a password." Fixes are available for the majority of affected products on the company's Web site, he said.
The bug was pointed out to Cisco on September 16 by a customer who was doing lab testing on a box, trying to find a different bug, Bashinski said. Cisco kept mum about it in order to have time to create fixes for all of the different software versions affected by the bug, he said.
"We needed to get sufficient numbers of those versions out to cover people before we could make any announcement," Bashinski said. He declined to characterise the seriousness of the bug, but one analyst said it could be real trouble.
Routers have "a critical role in the network", said Craig Mathias, principal at Farpoint Group in the US. "When (bugs occur) in a core product like this then it is definitely a concern," he said.
To find out what specific products and versions are affected, users can check Cisco's Web site at http://www.cisco.com/warp/public/770/ioshist-pub.shtml/ Cisco's Bashinski said. There is also a type-in feature which lets users check on a particular product, he said.