The hardware Voice Video Endpoint must not use the default PIN or password to access configuration and display of network IP settings.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-66791	SRG-NET-000512-VVEP-00055	SV-81281r1_rule		Medium

Description
Many Voice Video Endpoints can set or display configuration settings in the instrument itself. This presents a risk if a user obtains information such as the IP addresses and URLs of system components. This obtained information could be used to facilitate an attack on the system. Therefore these devices should be considered a target to be defended against individuals that would collect voice network information for illicit purposes. To mitigate information gathering by the adversaries, measures must be taken to protect this information.

Description

Many Voice Video Endpoints can set or display configuration settings in the instrument itself. This presents a risk if a user obtains information such as the IP addresses and URLs of system components. This obtained information could be used to facilitate an attack on the system. Therefore these devices should be considered a target to be defended against individuals that would collect voice network information for illicit purposes. To mitigate information gathering by the adversaries, measures must be taken to protect this information.

STIG	Date
Voice Video Endpoint Security Requirements Guide	2017-01-04

Details

Check Text ( C-67441r1_chk )
If the Voice Video Endpoint is not a hardware endpoint, this check procedure is Not Applicable. Verify the hardware Voice Video Endpoint does not use the default PIN or password to access configuration and display of network IP settings. If the hardware Voice Video Endpoint uses the default PIN or password to access configuration and display of network IP settings, this is a finding.

Fix Text (F-72891r1_fix)
Configure the hardware Voice Video Endpoint to not use the default PIN or password to access configuration and display of network IP settings.