Rule:--Sid:2406--Summary:This event is generated when an attempt is made to access an APC deviceusing a known default administrative account and password via Telnet.--Impact:Serious. Unauthorized administrative access to the device.--Detailed Information:The APC Management card uses a known default administrative name andpassword. This rule generates an event when these credentials are usedin a Telnet session. If this account and password have not been changedthis can lead to unauthorized administrative access to the device.--Affected Systems:	APC WEB/SNMP Management Card (9606) Firmware 3.0 and 3.0.1--Attack Scenarios:An attacker may try to use this password and username combination togain access to an affected device.--Ease of Attack:Simple.--False Positives:None known.--False Negatives:None known.--Corrective Action:Ensure the system is using an up to date version of the software and hashad all vendor supplied patches applied.Change the administrative account username and password.--Contributors:Sourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--