PT-2019-1737 · Cisco · Cisco Ios Xe

Publicado 2019-03-27 · Atualizado 2019-10-09 · CVE-2019-1755

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue exists due to insufficient input validation in the Web Services Management Agent (WSMA) component of Cisco IOS XE Software. This allows a remote attacker to execute arbitrary commands by sending specially crafted HTTP requests. The vulnerability occurs because the affected software improperly sanitizes user-supplied input, potentially leading to the execution of arbitrary Cisco IOS commands as a privilege level 15 user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-01375

CVE-2019-1755

Produtos afetados

Cisco Ios Xe

Referências · 5

• http://securityfocus.com/bid/107380 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1755 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-01375 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1755 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-cmdinj · Aviso do Fabricante