Cisco Firewall Breach Exposes Lax Security at Major Pharmacy Chain

"That is an edge firewall... It had the enable password as 'password.' Just p-a-s-s-w-o-r-d."

Dahvid Schloss’s audit of a large US pharmacy retailer

Dahvid Schloss, a red team and penetration‑testing specialist who serves as COO of Suzu Labs, was hired to audit the corporate switches, routers, and firewalls for a large US pharmacy retailer that he asked not to be named. Schloss said he was not asked to break in but to review configuration files and controls. During that audit he encountered an edge Cisco firewall whose administrator (enable) password was literally "password." Schloss reported the finding as a "high find."

Cisco IOS type 7 storage and how the file was read

Schloss said the enable password was stored as Cisco IOS type 7. He described that format as "isn't really a hash," calling it "more of a reversible encoding with a publicly known key," and said breaking Cisco's protection to decrypt the file holding the passwords is easy to do. Schloss did not have to guess the value; he decrypted the file and read the plaintext credential.

What an attacker could do with those credentials

By design, the enable command on Cisco devices grants administrative rights. Schloss explained that if someone connected to that firewall — either via SSH or through an exploit — and obtained normal user privileges, they could elevate to administrator with the enable password. He warned that an attacker who achieved that elevation could, for example, shut off all traffic from the intranet to the outside world.

The hour‑long conflict: auditors, IT, and compensation

When Schloss presented the finding to the client, the auditing department convened a call that included the auditing team, the entire IT team, Schloss's manager, and others. According to Schloss, the audit team immediately treated the firewall password as a serious issue: "the directors were really harping on 'this needs to be done.'" The IT group pushed back, arguing it was not a high‑priority problem and suggesting it might be a medium severity at best. The two sides shouted at one another for more than an hour while Schloss and his colleagues "sat there quietly, staring at their cameras," and he was not able to finish presenting his findings and recommendations during that session.

How incentive design shaped reactions and the longer fallout

Schloss later learned the auditing department controlled bonuses for the IT team and that the bonus scheme included a stipulation: any "high finding" would eliminate those bonuses. That compensation link, Schloss concluded, was the real subject of the dispute — not merely the single password. The conflict persisted beyond the call; the client continued to ask Schloss to explain the same finding again for the next three years, long after he had moved on to other projects.

What this means for technologists, auditors, and enterprise leaders

• Technologists and security teams: A plaintext or trivially reversible administrator password on an internet‑facing firewall can enable privilege escalation and operational disruption if an attacker gains a foothold. Schloss’s experience underscores how a single weak credential can be both easy to discover and consequential.
• Auditors and compliance leaders: The auditing team treated the finding as high severity and repeatedly pressed for remediation. The episode shows how audit classifications can collide with other organizational pressures when those classifications carry direct financial consequences for operational teams.
• Enterprise leaders and compensation designers: Tying security posture directly to employee bonuses — as the client’s auditing department reportedly did — can create incentives to minimize or deny problems when they are found, the story suggests. Schloss framed the moral succinctly: the lesson is more than "don’t use the word 'password' as a password." It is also about misaligned incentives.

The episode at this unnamed pharmacy chain is stark because it combines a low‑effort technical failure with a high‑friction organizational failure. The technical problem — an edge firewall whose enable password was "password," stored in a reversible Cisco IOS type 7 encoding — is straightforward to fix. The harder question raised by Schloss’s account is whether incentive structures that tie security classifications to pay create pressures that obstruct remediation rather than accelerate it. For this client, that question turned an audit finding into a three‑year replay of the same argument.

Original story: The Register — IT department and auditors at major pharmacy chain got into a rip‑roaring fight about using 'password' on Cisco firewall