PT-2018-8660 · Cisco · Cisco Ios Xe

Published 2018-03-28 · Updated 2019-10-09 · CVE-2018-0193

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified)

Description: The issue allows an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, potentially gaining access to the underlying Linux shell of an affected device and executing commands with root privileges. This is due to the affected software not sufficiently sanitizing command arguments before passing commands to the Linux shell for execution. An attacker could exploit this by submitting a malicious CLI command. A successful exploit could allow the attacker to break from the CLI and execute arbitrary commands with root privileges on the device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-0193

Affected Products

Cisco Ios Xe

References · 4

• https://osv.dev/vulnerability/CVE-2018-0193 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-cmdinj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0193 · Security Note
• http://securityfocus.com/bid/103547 · Note