PT-2019-1712 · Cisco · Cisco Ios Xe

Publicado 2019-03-27 · Atualizado 2020-10-09 · CVE-2019-1743

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the device. An exploit could allow the attacker to gain elevated privileges on the affected device.

Recommendations For Cisco IOS XE Software, update to a version that includes the software updates released by Cisco to address this vulnerability. At the moment, there is no information about specific affected versions that contains a fix for this vulnerability, however, it is recommended to follow the Cisco Security Advisory for the March 27, 2019, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication for more information on the fixed software updates.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-01330

CVE-2019-1743

Produtos afetados

Cisco Ios Xe

Referências · 5

• http://securityfocus.com/bid/107591 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-afu · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1743 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01330 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1743 · Nota de Segurança