Unknown users logged into cisco router

Question

Good day!

I logged into a Cisco management router located in our company network and issue the show users command and it gave the following output. The 3rd line vty 4 is me. I am concerned of the 2 other entries because I am 100% sure no one except me should be logged into the router from the inside during this hour. Also, the entries do not contain usernames. I've traced the IPs of these users to different locations around the globe. The output of the command changes from time to time.

What do these entries without username mean?

Thank you!

score 3 · Accepted Answer · answered Jul 24 '16 at 10:08

3

That means that someone connected but hasn't entered a username and password yet.

answered Jul 24 '16 at 10:08

longneck

22,793
4
50
84

So the router has not been compromised? – ultrajohn Jul 24 '16 at 10:15
2

I'm not going to authoritatively state that. That is the typical behavior of unauthenticated sessions. – longneck Jul 24 '16 at 10:22

Unknown users logged into cisco router

1 Answers1