Victor Kamensky

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software versions prior to the fixed version Description: The issue is related to improper checks performed by system boot routines in the fast reload feature of Cisco IOS XE Software. This could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system, install and boot a malicious software image, or execute unsigned binaries on an affected device. The attacker would need privileged access to the CLI of the device to exploit these vulnerabilities. A successful exploit could allow the attacker to either execute arbitrary code on the underlying operating system or execute unsigned code and bypass the image verification check part of the secure boot process. Recommendations: For Cisco IOS XE Software, update to a version that includes the fix for these vulnerabilities. As a temporary workaround, consider restricting access to the CLI of the device to minimize the risk of exploitation. Avoid using the fast reload feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software versions prior to the fixed version Description: The issue is related to improper checks performed by system boot routines in the fast reload feature of Cisco IOS XE Software. This could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system, install and boot a malicious software image, or execute unsigned binaries on an affected device. The attacker would need privileged access to the CLI of the device to exploit these vulnerabilities. A successful exploit could allow the attacker to either execute arbitrary code on the underlying operating system or execute unsigned code and bypass the image verification check part of the secure boot process. Recommendations: For Cisco IOS XE Software, update to a version that includes the fix for these vulnerabilities. As a temporary workaround, consider restricting access to the CLI of the device to minimize the risk of exploitation. Avoid using the fast reload feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco IOS XE Software (affected versions not specified) **Description** A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services Routers with a Route Switch Processor 3 (RSP3) installed (affected versions not specified) Description: The issue is related to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set, allowing an authenticated, local attacker with high privileges to execute persistent code at bootup and break the chain of trust. An attacker could exploit this by copying a specific file to the local file system of an affected device and defining specific ROMMON variables, potentially allowing the attacker to run arbitrary code on the underlying operating system (OS) with root privileges. To exploit, an attacker would need to have access to the root shell on the device or have physical access to the device. Recommendations: For Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services Routers with a Route Switch Processor 3 (RSP3) installed, update to a version that includes the software updates released by Cisco to address these vulnerabilities. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services Routers with a Route Switch Processor 3 (RSP3) installed (affected versions not specified) Description: The issue is related to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set, allowing an authenticated, local attacker with high privileges to execute persistent code at bootup and break the chain of trust. An attacker could exploit this by copying a specific file to the local file system of an affected device and defining specific ROMMON variables, potentially allowing the attacker to run arbitrary code on the underlying operating system (OS) with root privileges. To exploit, an attacker would need to have access to the root shell on the device or have physical access to the device. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified) Description: A vulnerability in the application-hosting subsystem could allow an authenticated, local attacker to elevate privileges to root on an affected device. The attacker could execute IOS XE commands outside the application-hosting subsystem Docker container as well as on the underlying Linux operating system. These commands could be run as the root user. The vulnerability is due to a combination of two factors: (a) incomplete input validation of the user payload of CLI commands, and (b) improper role-based access control (RBAC) when commands are issued at the command line within the application-hosting subsystem. An attacker could exploit this vulnerability by using a CLI command with crafted user input. A successful exploit could allow the lower-privileged attacker to execute arbitrary CLI commands with root privileges. The attacker would need valid user credentials to exploit this vulnerability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.