Cisco ASR StarOS Multiple CLI Command Injection Vulnerabilities (cisco-sa-20180117-staros / cisco-sa-20180307-staros / cisco-sa-20180307-staros1)

High Nessus Plugin ID 107095


The remote device is affected by multiple command injection vulnerabilities.


According to its self-reported version and model number, the remote Cisco ASR device is affected by multiple command injection vulnerabilities due to improper validation of user input. An authenticated local attacker, using command arguments, could potentially execute arbitrary commands with root privileges.


Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvf93332, CSCvg29441, or CSCvg38807.

See Also

Plugin Details

Severity: High

ID: 107095

File Name: cisco-sa-20180117-staros.nasl

Version: 1.3

Type: local

Family: CISCO

Published: 2018/03/02

Modified: 2018/03/22

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.2

Temporal Score: 6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND


Base Score: 6.7

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:X

Vulnerability Information

CPE: cpe:/o:cisco:staros, cpe:/h:cisco:asr_5000, cpe:/a:cisco:asr_5000_series_software

Required KB Items: Host/Cisco/ASR/Model, Host/Cisco/StarOS, Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2018/01/17

Vulnerability Publication Date: 2018/01/17

Reference Information

CVE: CVE-2018-0115, CVE-2018-0217, CVE-2018-0224

BID: 102788, 103344, 103346

OSVDB: 173072, 176304, 176305

CISCO-BUG-ID: CSCvf93332, CSCvg29441, CSCvg38807

CISCO-SA: cisco-sa-20180117-staros, cisco-sa-20180307-staros, cisco-sa-20180307-staros1

IAVB: 2018-B-0029