The Enterprise Voice, Video, and Messaging Endpoint must not be configured with any vendor default accounts, PINs, or passwords to access configuration settings.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-259940 | SRG-NET-000015-VVEP-00100 | SV-259940r948789_rule | CCI-000213 | medium |
| Description | ||||
| Many Enterprise Voice, Video, and Messaging Endpoints can set or display configuration settings in the instrument itself. This presents a risk if a user obtains information such as the IP addresses and URLs of system components. This obtained information could be used to facilitate an attack on the system. Therefore, these devices should be considered a target to be defended against individuals that would collect voice network information for illicit purposes. To mitigate information gathering by the adversaries, measures must be taken to protect this information. | ||||
| STIG | Date | |||
| Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide | 2024-08-02 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AC-3
1.00
- DISA · 1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.1.1
1.00
- DISA · 1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.1.2
1.00
- DISA · 1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000213
1.00
- DISA · 1 · disa_xccdf · related
Details
Check Text (C-259940r948789_chk)
Verify the Enterprise Voice, Video, and Messaging Endpoint does not use the default PIN or password to access configuration settings.
If the Enterprise Voice, Video, and Messaging Endpoint uses the default PIN or password to access configuration settings, this is a finding.
Fix Text (F-63578r948788_fix)
Configure the Enterprise Voice, Video, and Messaging Endpoint to not use the default PIN or password to access configuration settings.