PT-2018-8660 · Cisco · Cisco Ios Xe

Publicado 2018-03-28 · Atualizado 2019-10-09 · CVE-2018-0193

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified)

Description: The issue allows an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, potentially gaining access to the underlying Linux shell of an affected device and executing commands with root privileges. This is due to the affected software not sufficiently sanitizing command arguments before passing commands to the Linux shell for execution. An attacker could exploit this by submitting a malicious CLI command. A successful exploit could allow the attacker to break from the CLI and execute arbitrary commands with root privileges on the device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-0193

Produtos afetados

Cisco Ios Xe

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-0193 · Aviso do Fabricante
• http://securityfocus.com/bid/103547 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-cmdinj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0193 · Nota de Segurança