PT-2018-1182 · Cisco · Cisco Ios Xe

Publicado 2018-03-28 · Atualizado 2019-10-09 · CVE-2018-0194

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the CLI parser of Cisco IOS XE Software. These vulnerabilities could allow an authenticated, local attacker to inject arbitrary commands into the CLI, potentially gaining access to the underlying Linux shell of an affected device and executing commands with root privileges. The vulnerabilities exist because the affected software does not sufficiently sanitize command arguments before passing commands to the Linux shell for execution. An attacker could exploit these vulnerabilities by submitting a malicious CLI command. A successful exploit could allow the attacker to break from the CLI and gain access to the underlying Linux shell, executing arbitrary commands with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2018-00640

CVE-2018-0194

Produtos afetados

Cisco Ios Xe

Referências · 5

• http://securityfocus.com/bid/103547 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-cmdinj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0194 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00640 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-0194 · Aviso do Fabricante