PT-2018-13003 · Cisco · Cisco Ios Xe

Publicado 2018-09-26 · Atualizado 2019-10-09 · CVE-2018-15371

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the shell access request mechanism could allow an authenticated, local attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The issue exists due to insufficient authentication mechanisms for certain commands. An attacker could exploit this by requesting access to the root shell after the shell access feature has been enabled, potentially gaining unrestricted access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Authentication

Enumeração de Fraquezas

CWE-284

CWE-287

Identificadores relacionados

CVE-2018-15371

Produtos afetados

Cisco Ios Xe

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-15371 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-shell-access · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15371 · Nota de Segurança