PT-2000-1857 · Cisco · Catalyst 3500 Xl

Published 2000-12-19 · Updated 2017-10-10 · CVE-2000-0945

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Catalyst 3500 XL switches (affected versions not specified)

Description The issue concerns the web configuration interface of the Catalyst 3500 XL switches, which allows remote attackers to execute arbitrary commands without authentication when the enable password is not set. This can be achieved by accessing a URL containing the /exec/ directory.

Recommendations For Catalyst 3500 XL switches, set an enable password to prevent unauthorized access and execution of arbitrary commands.

Exploit

Fix

Related Identifiers

CVE-2000-0945

Affected Products

Catalyst 3500 Xl

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/cisco_device_manager.rb · Exploit
• 🔥 https://exploit-db.com/exploits/20330 · Exploit
• http://archives.neohapsis.com/archives/bugtraq/2000-10/0380.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0945 · Security Note
• http://securityfocus.com/bid/1846 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5415 · Note
• http://archives.neohapsis.com/archives/bugtraq/2000-11/0194.html · Note
• http://osvdb.org/444 · Note