PT-2020-1386 · Cisco · Cisco Ios Xe+1

Mehmet Önder Key · Published 2020-01-08 · Updated 2020-09-28 · CVE-2019-16009

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS and Cisco IOS XE Software (affected versions not specified)

Description The issue is related to insufficient CSRF protections for the web UI on affected devices, allowing an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. An attacker could exploit this by persuading a user of the interface to follow a malicious link, potentially allowing the attacker to perform arbitrary actions with the privilege level of the targeted user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or reload an affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the web UI to minimize the risk of exploitation. Avoid using the web UI until the issue is resolved. Restrict access to the vulnerable web UI to minimize the risk of exploitation. Consider disabling the web UI until a patch is available.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2020-00336

CVE-2019-16009

Affected Products

Cisco Ios

Cisco Ios Xe

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-16009 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/643339 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16009 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ios-csrf · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ios-csrf · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00336 · Security Note
• https://t.me/cibsecurity/14831 · Telegram Post