PT-2018-2014 · Cisco · Cisco Ios Rom Monitor (Rommon)+2

Published 2018-09-26 · Updated 2019-10-09 · CVE-2018-15370

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Catalyst 6800 Series Switches (affected versions not specified)

Description A vulnerability in the Cisco IOS ROM Monitor (ROMMON) Software could allow an unauthenticated, local attacker to bypass Cisco Secure Boot validation checks and load a compromised software image on an affected device. The issue is due to the presence of a hidden command in the affected software. An attacker could exploit this by connecting to the device via the console, forcing it into ROMMON mode, and writing a malicious pattern to a specific memory address. A successful exploit could allow the attacker to bypass signature validation checks by Cisco Secure Boot technology and load a compromised software image. A compromised software image is any software image that has not been digitally signed by Cisco.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2018-01630

CVE-2018-15370

Affected Products

Cisco Catalyst 6800 Series Switches

Cisco Ios Rom Monitor (Rommon)

Cisco Secure Boot

References · 8

• https://bdu.fstec.ru/vul/2018-01630 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-catalyst6800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15370 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15370 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-catatyst6800 · Note
• http://securityfocus.com/bid/105412 · Note
• https://nist.nvd.gob/vuln/detail/CVE-2018-15370 · Note
• https://securityfocus.com/bid/105412/info · Note