PT-2017-2017 · Cisco · Cisco Ios Xe

Publicado 2017-03-22 · Atualizado 2017-07-12 · CVE-2017-3858

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software version 16.2.1

Description A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the affected web page parameter. A successful exploit could allow the attacker to execute commands with root privileges.

Recommendations For Cisco IOS XE Software version 16.2.1, update to a newer version that addresses this vulnerability. As a temporary workaround, consider restricting access to the HTTP Server feature to minimize the risk of exploitation. Avoid using the affected web page parameter until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-01184

CVE-2017-3858

Produtos afetados

Cisco Ios Xe

Referências · 6

• http://securitytracker.com/id/1038102 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3858 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-01184 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-xeci · Aviso do Fabricante
• http://securityfocus.com/bid/97009 · Nota
• https://osv.dev/vulnerability/CVE-2017-3858 · Aviso do Fabricante