PT-2019-3331 · Cisco · Cisco Ios Xe

Publicado 2019-09-25 · Atualizado 2019-10-09 · CVE-2019-12661

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue is related to insufficient validation of arguments passed to a specific Virtualization Manager (VMAN) CLI command, allowing an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. This could lead to complete system compromise. An attacker with administrator access to an affected device could exploit this by including malicious input as the argument of an affected command.

Recommendations For Cisco IOS XE Software, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. At the moment, there is no information about specific versions that contain a fix for this vulnerability, but it is recommended to check for and apply the latest software updates from Cisco.

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2019-03438

CVE-2019-12661

Produtos afetados

Cisco Ios Xe

Referências · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-vman-cmd-injection · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12661 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12661 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-03438 · Nota de Segurança