PT-2019-1737 · Cisco · Cisco Ios Xe

Published 2019-03-27 · Updated 2019-10-09 · CVE-2019-1755

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description The issue exists due to insufficient input validation in the Web Services Management Agent (WSMA) component of Cisco IOS XE Software. This allows a remote attacker to execute arbitrary commands by sending specially crafted HTTP requests. The vulnerability occurs because the affected software improperly sanitizes user-supplied input, potentially leading to the execution of arbitrary Cisco IOS commands as a privilege level 15 user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-01375

CVE-2019-1755

Affected Products

Cisco Ios Xe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-1755 · Security Note
• https://bdu.fstec.ru/vul/2019-01375 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1755 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-cmdinj · Vendor Advisory
• http://securityfocus.com/bid/107380 · Note