PT-2017-2982 · Cisco · Cisco Ios Xe

Publicado 2017-09-27 · Atualizado 2019-10-09 · CVE-2017-12229

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.1 through 16.5

Description A vulnerability in the REST API of the web-based user interface of Cisco IOS XE could allow an unauthenticated, remote attacker to bypass authentication by sending a malicious API request to an affected device. The issue is due to insufficient input validation for the REST API. A successful exploit could allow the attacker to gain access to the web UI of the affected software. This vulnerability affects devices with the HTTP Server feature enabled.

Recommendations For Cisco IOS XE versions 3.1 through 16.5, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. As a temporary workaround, consider disabling the HTTP Server feature to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2017-02324

CVE-2017-12229

Produtos afetados

Cisco Ios Xe

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-12229 · Aviso do Fabricante
• http://securitytracker.com/id/1039447 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-restapi · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12229 · Nota de Segurança
• http://securityfocus.com/bid/101032 · Nota
• https://bdu.fstec.ru/vul/2017-02324 · Nota de Segurança