Cisco IOS XE Software Web Based Management Interface Denial of Service (cisco-sa-webui-dos-qdc7qx3)

#TRUSTED 37322f6014b642a0d998e1015d285b0454c73898c527d65536cda3dceafaf9039597e1a81f7e80acfd720d9edc390545c9ac5ab7f67ec7ebbaedfb24d73c9350b899897969bd7f66a3188dbf126688b499425ace0805b131d62012834d9e2a689a045408915332ed8f65d4947d5794d30d2994c925e612875e858ce74c118b3ab40af1faf7954062d0bb311e6258e82af659b1ec11351ba3dd0249dad17add5a77471cdf9f925a0814c9c1c8137f049540eebdc77e7294ead1336bf21648b8670a0055af7c45d45d09c51ee2a5f3a010f1e86145ce656b71867c194e3bdb12957e0063ed27bca870b3fe96b4ea385412f1d367db203efa05586bce6aee6f02f2f4639231a53cadb2734597c0fc54f43b71f7a4726817fe7c4ef493534a8d66395b263d2999509584683158a300b0a36a49f0de07d257c06d34575c3ec392c22197ec06d1baf4dca6b8d1a7baa103b01891ed9e29bd06b3891ee7bdd89e6fdc972cd434e643569ce140064365b382c2f16d86c533ea1c44aa411cc67a8b8a8f0b0ae4d6f2d56815f5226be8fca99f0814a37973a061f4f5996c49b35ab897d257c50987aac446c8809037e5a54e5902235e3106ac17cd17f9e1f9fe605795fd8b1d7a62373dc26926974db5962cbdc315430d68933d09ebcd1691764becba3bd9ebd7639e4b6695147f9f9e3c45bbb3b22d867a2f33225d44b3e897662d08d44c
#TRUST-RSA-SHA256 5792f0dbccbfe0e769f1cdd8c64dc5b199a0ab77f19dc1bfa0d48102cf9fdd5c8777429a81a1596e614208f3c3abd40b394a05a994089fad783af9c949447c04c35d80bbcb1f3b5ae149c8cb4167a64c514674895046f857b06a7ebf5afeddb55445b43ffafa087b3dfcab65ed0200884344d5a3653cce12505aaef886efba4f91b4bac89d8622fbb8fd0e028b0648e6ad2aecf2578abf4ad1bdbd95c16cee08dc4bb6baaa1c26f3db66231a4be9db65b53496eee1a477a5fb5248baf0119fe6e939f91f1cfcf40691bb264c150dc77b7e9d6b41c2ee50b82dd6456b68dcc69bf8296df7608d394e6e2702d38e77b9952e38c0b6dd7ea2e55247e873c6ad58da512e0e0e2ff1fbb3eccd3463324b1a5993e3898e7d7848ee8ccf14c33d3d059711d96b14c3f88810b29febdd1cd3bc5183fbdd3d9d8671ae47d3ecbebc2fb5f91d156a51b047f23ebd439d3d216230cdc16c456da3438d2abb448793a13d70d41bcc05bed7b1873c58974aedadb432a8b555c6e98f49548f850797243958b293a371b9938e867d5940e04bd3d327cdcab29769f2d17a7d623c2e150f3df612c05766617847f5f5523283de08d8ed327d2fb02db5b7f68cd1979a971d37b75db9ccc12b5b49a9287c9e954cc6576347b04442d0d4301a8097c906dece4372dbdddc1e9d42c9085fe7d5064ab253a8ce607388569e54c2d610a90d2cd411d3bb03
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339124);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/25");

  script_cve_id("CVE-2026-20308");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu19075");
  script_xref(name:"CISCO-SA", value:"cisco-sa-webui-dos-qdc7qx3");
  script_xref(name:"IAVA", value:"2026-A-0807");

  script_name(english:"Cisco IOS XE Software Web Based Management Interface Denial of Service (cisco-sa-webui-dos-qdc7qx3)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability.

  - A denial of service (DoS) vulnerability exists in the web-based management interface of Cisco IOS XE
    Software due to insufficient input validation. An authenticated, remote attacker can exploit this issue,
    via sending crafted input to the web-based management interface, to cause the web-based management
    interface to stop responding. (CVE-2026-20308)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-dos-qdc7qx3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?badb66cd");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu19075");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu19075");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20308");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(269);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/24");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

var version_list=make_list(
  '16.9.1',
  '16.9.1a',
  '16.9.1b',
  '16.9.1c',
  '16.9.1d',
  '16.9.1s',
  '16.9.2',
  '16.9.2a',
  '16.9.2s',
  '16.9.3',
  '16.9.3a',
  '16.9.3h',
  '16.9.3s',
  '16.9.4',
  '16.9.4c',
  '16.9.5',
  '16.9.5f',
  '16.9.6',
  '16.9.7',
  '16.9.8',
  '16.9.8a',
  '16.9.8b',
  '16.10.1',
  '16.10.1a',
  '16.10.1b',
  '16.10.1c',
  '16.10.1d',
  '16.10.1e',
  '16.10.1f',
  '16.10.1g',
  '16.10.1s',
  '16.10.2',
  '16.10.3',
  '16.11.1',
  '16.11.1a',
  '16.11.1b',
  '16.11.1c',
  '16.11.1s',
  '16.11.2',
  '16.12.1',
  '16.12.1a',
  '16.12.1c',
  '16.12.1s',
  '16.12.1t',
  '16.12.1w',
  '16.12.1x',
  '16.12.1y',
  '16.12.1z',
  '16.12.1z1',
  '16.12.1z2',
  '16.12.2',
  '16.12.2a',
  '16.12.2s',
  '16.12.2t',
  '16.12.3',
  '16.12.3a',
  '16.12.3s',
  '16.12.4',
  '16.12.4a',
  '16.12.5',
  '16.12.5a',
  '16.12.5b',
  '16.12.6',
  '16.12.6a',
  '16.12.7',
  '16.12.8',
  '16.12.9',
  '16.12.10',
  '16.12.10a',
  '16.12.11',
  '16.12.12',
  '16.12.13',
  '16.12.14',
  '16.12.15',
  '17.1.1',
  '17.1.1a',
  '17.1.1s',
  '17.1.1t',
  '17.1.2',
  '17.1.3',
  '17.2.1',
  '17.2.1a',
  '17.2.1r',
  '17.2.1v',
  '17.2.2',
  '17.2.3',
  '17.3.1',
  '17.3.1a',
  '17.3.1w',
  '17.3.1x',
  '17.3.1z',
  '17.3.2',
  '17.3.2a',
  '17.3.3',
  '17.3.3a',
  '17.3.4',
  '17.3.4a',
  '17.3.4b',
  '17.3.4c',
  '17.3.5',
  '17.3.5a',
  '17.3.5b',
  '17.3.6',
  '17.3.7',
  '17.3.8',
  '17.3.8a',
  '17.4.1',
  '17.4.1a',
  '17.4.1b',
  '17.4.1c',
  '17.4.2',
  '17.4.2a',
  '17.5.1',
  '17.5.1a',
  '17.5.1b',
  '17.5.1c',
  '17.6.1',
  '17.6.1a',
  '17.6.1w',
  '17.6.1x',
  '17.6.1y',
  '17.6.1z',
  '17.6.1z1',
  '17.6.2',
  '17.6.3',
  '17.6.3a',
  '17.6.4',
  '17.6.5',
  '17.6.5a',
  '17.6.6',
  '17.6.6a',
  '17.6.7',
  '17.6.8',
  '17.6.8a',
  '17.7.1',
  '17.7.1a',
  '17.7.1b',
  '17.7.2',
  '17.8.1',
  '17.8.1a',
  '17.9.1',
  '17.9.1a',
  '17.9.1w',
  '17.9.1x',
  '17.9.1x1',
  '17.9.1y',
  '17.9.1y1',
  '17.9.2',
  '17.9.2a',
  '17.9.3',
  '17.9.3a',
  '17.9.4',
  '17.9.4a',
  '17.9.5',
  '17.9.5a',
  '17.9.5b',
  '17.9.5c',
  '17.9.5d',
  '17.9.5e',
  '17.9.5f',
  '17.9.6',
  '17.9.6a',
  '17.9.6b',
  '17.9.7',
  '17.9.7a',
  '17.9.7b',
  '17.9.8',
  '17.9.9',
  '17.10.1',
  '17.10.1a',
  '17.10.1b',
  '17.11.1',
  '17.11.1a',
  '17.12.1',
  '17.12.1a',
  '17.12.1w',
  '17.12.1x',
  '17.12.1y',
  '17.12.1z',
  '17.12.1z1',
  '17.12.1z2',
  '17.12.1z3',
  '17.12.1z4',
  '17.12.1z5',
  '17.12.1z6',
  '17.12.2',
  '17.12.2a',
  '17.12.3',
  '17.12.3a',
  '17.12.4',
  '17.12.4a',
  '17.12.4b',
  '17.12.5',
  '17.12.5a',
  '17.12.5b',
  '17.12.5c',
  '17.12.5d',
  '17.12.6',
  '17.12.6a',
  '17.12.6b',
  '17.12.7',
  '17.12.7a',
  '17.12.7b',
  '17.13.1',
  '17.13.1a',
  '17.14.1',
  '17.14.1a',
  '17.15.1',
  '17.15.1a',
  '17.15.1b',
  '17.15.1w',
  '17.15.1x',
  '17.15.1y',
  '17.15.1z',
  '17.15.2',
  '17.15.2a',
  '17.15.2b',
  '17.15.2c',
  '17.15.3',
  '17.15.3a',
  '17.15.3b',
  '17.15.4',
  '17.15.4a',
  '17.15.4b',
  '17.15.4c',
  '17.15.4d',
  '17.15.4s1',
  '17.15.5',
  '17.15.5a',
  '17.16.1',
  '17.16.1a',
  '17.17.1',
  '17.18.1',
  '17.18.1a',
  '17.18.1w',
  '17.18.1x',
  '17.18.1y',
  '17.18.1z',
  '17.18.2',
  '17.18.3',
  '17.18.3a',
  '26.1.1',
  '26.1.1a',
  '26.2.1ea'
);

var workarounds = make_list(CISCO_WORKAROUNDS['HTTP_Server_iosxe']);
var workaround_params = {'no_active_sessions' : 1};

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_WARNING,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwu19075',
  'cmds'    , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);