Lucene search

[email protected]CVE-2019-12671

HistorySep 25, 2019 - 9:15 p.m.

CVE-2019-12671

2019-09-2521:15:11

CWE-863

CWE-285

[email protected]

web.nvd.nist.gov

vulnerability

cisco

ios xe software

cli

shell access

command execution

nvd

cve-2019-12671

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS). The vulnerability is due to insufficient enforcement of the consent token in authorizing shell access. An attacker could exploit this vulnerability by authenticating to the CLI and requesting shell access on an affected device. A successful exploit could allow the attacker to gain shell access on the affected device and execute commands on the underlying OS.

Affected configurations

NVD

Node

ciscoios_xeMatch16.11.1

ciscoios_xeMatch16.11.1a

AND

cisco4321\/k9-rf_integrated_services_routerMatch-

cisco4321\/k9-ws_integrated_services_routerMatch-

cisco4321\/k9_integrated_services_routerMatch-

cisco4331\/k9-rf_integrated_services_routerMatch-

cisco4331\/k9-ws_integrated_services_routerMatch-

cisco4331\/k9_integrated_services_routerMatch-

cisco4351\/k9-rf_integrated_services_routerMatch-

cisco4351\/k9-ws_integrated_services_routerMatch-

cisco4351\/k9_integrated_services_routerMatch-

ciscoasr1001-hxMatch-

ciscoasr1001-hx-rfMatch-

ciscoasr1001-xMatch-

ciscoasr1001-x-rfMatch-

ciscoasr1001-x-wsMatch-

ciscoasr1002-hxMatch-

ciscoasr1002-hx-rfMatch-

ciscoasr1002-hx-wsMatch-

ciscoasr1002-xMatch-

ciscoasr1002-x-rfMatch-

ciscoasr1002-x-wsMatch-

ciscoc1117-4pMatch-

ciscoc1117-4plteeaMatch-

ciscoc1117-4pltelaMatch-

ciscoencs5412\/k9Match-

ciscoencs5412\/k9-rfMatch-

ciscosasr1k1xucmk9-1610Match-

ciscosasr1k2xucmk9-1610Match-

ciscosasr1khxucmk9-1610Match-

ciscosisr1100ucmk9-1610Match-

CPENameOperatorVersion
cisco:ios_xecisco ios xeeq16.11.1

CPE	Name	Operator	Version
cisco:ios_xe	cisco ios xe	eq	16.11.1

CNA Affected

[
  {
    "product": "Cisco IOS XE Software 3.2.9SG",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-ctbypass

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-12671

nessus1 nvd1 cisco1 prion1 cvelist1