Cisco IOS XE Software Privileged EXEC Mode Root Shell Access Vulnerability

medium Nessus Plugin ID 125031

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device.The vulnerability is due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device.

Please see the included Cisco BIDs and Cisco Security Advisory for more information

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCve74432

Plugin Details

Severity: Medium

ID: 125031

File Name: cisco-sa-20180328-privesc2.nasl

Version: 1.9

Type: local

Family: CISCO

Published: 5/14/2019

Updated: 1/8/2021

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2018-0184

CVSS v3

Risk Factor: Medium

Base Score: 6.7

Temporal Score: 5.8

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:ios_xe

Required KB Items: Settings/ParanoidReport, Host/Cisco/IOS-XE/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 3/28/2018

Vulnerability Publication Date: 3/28/2018

Reference Information

CVE: CVE-2018-0184

BID: 103550

CWE: 264

CISCO-SA: cisco-sa-20180328-privesc2

CISCO-BUG-ID: CSCve74432

Detections

Analytics