PT-2017-2019 · Cisco · Cisco Ios Xe
Publicado
2017-03-22
·
Atualizado
2019-10-03
·
CVE-2017-3856
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco IOS XE versions 3.1 through 3.17
Description
A vulnerability in the web user interface of Cisco IOS XE could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. An attacker could exploit this vulnerability by sending a high number of requests to the web user interface of the affected software. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. To exploit this vulnerability, the attacker must have access to the management interface of the affected software, which is typically connected to a restricted management network.
Recommendations
For Cisco IOS XE versions 3.1 through 3.17, update to a fixed release of Cisco IOS XE Software to address this vulnerability.
As a temporary workaround, consider restricting access to the management interface of the affected software to minimize the risk of exploitation.
Avoid sending a high number of requests to the web user interface of the affected software until the issue is resolved.
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Ios Xe