Lucene search

CiscoCISCO-SA-IOSXE-WEBCMDINJSH-UFJXTGZD

HistoryMar 24, 2021 - 4:00 p.m.

Cisco IOS XE Software Web UI Command Injection Vulnerability

2021-03-2416:00:00

tools.cisco.com

cisco

ios xe

software

web ui

vulnerability

command injection

authenticated

remote attacker

arbitrary commands

root user

privilege escalation

insufficient input validation

software updates

ciscosecurityadvisory

EPSS

0.002

Percentile

53.5%

JSON

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user.

This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web UI of an affected device with arbitrary commands injected into a portion of the request. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webcmdinjsh-UFJxTgZD [“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webcmdinjsh-UFJxTgZD”]

Affected configurations

Vulners

Node

ciscocisco_ios_xe_softwareMatch16.9

ciscocisco_ios_xe_softwareMatch16.10

ciscocisco_ios_xe_softwareMatch16.11

ciscocisco_ios_xe_softwareMatch17.2

ciscocisco_ios_xe_softwareMatchany

ciscoios_xe_sd-wanMatchany

ciscocisco_ios_xe_softwareMatch16.9.1

ciscocisco_ios_xe_softwareMatch16.9.2

ciscocisco_ios_xe_softwareMatch16.9.1a

ciscocisco_ios_xe_softwareMatch16.9.1b

ciscocisco_ios_xe_softwareMatch16.9.1s

ciscocisco_ios_xe_softwareMatch16.9.1c

ciscocisco_ios_xe_softwareMatch16.9.1d

ciscocisco_ios_xe_softwareMatch16.9.3

ciscocisco_ios_xe_softwareMatch16.9.2a

ciscocisco_ios_xe_softwareMatch16.9.2s

ciscocisco_ios_xe_softwareMatch16.9.3h

ciscocisco_ios_xe_softwareMatch16.9.4

ciscocisco_ios_xe_softwareMatch16.9.3s

ciscocisco_ios_xe_softwareMatch16.9.3a

ciscocisco_ios_xe_softwareMatch16.9.4c

ciscocisco_ios_xe_softwareMatch16.9.5

ciscocisco_ios_xe_softwareMatch16.9.5f

ciscocisco_ios_xe_softwareMatch16.9.6

ciscocisco_ios_xe_softwareMatch16.10.1

ciscocisco_ios_xe_softwareMatch16.10.1a

ciscocisco_ios_xe_softwareMatch16.10.1b

ciscocisco_ios_xe_softwareMatch16.10.1s

ciscocisco_ios_xe_softwareMatch16.10.1c

ciscocisco_ios_xe_softwareMatch16.10.1e

ciscocisco_ios_xe_softwareMatch16.10.1d

ciscocisco_ios_xe_softwareMatch16.10.2

ciscocisco_ios_xe_softwareMatch16.10.1f

ciscocisco_ios_xe_softwareMatch16.10.1g

ciscocisco_ios_xe_softwareMatch16.10.3

ciscocisco_ios_xe_softwareMatch16.11.1

ciscocisco_ios_xe_softwareMatch16.11.1a

ciscocisco_ios_xe_softwareMatch16.11.1b

ciscocisco_ios_xe_softwareMatch16.11.2

ciscocisco_ios_xe_softwareMatch16.11.1s

ciscocisco_ios_xe_softwareMatch16.11.1c

ciscocisco_ios_xe_softwareMatch17.2.1v

ciscocisco_ios_xe_softwareMatchany

ciscoios_xe_sd-wanMatchany

VendorProductVersionCPE
ciscocisco_ios_xe_software16.9cpe:2.3:a:cisco:cisco_ios_xe_software:16.9:*:*:*:*:*:*:*
ciscocisco_ios_xe_software16.10cpe:2.3:a:cisco:cisco_ios_xe_software:16.10:*:*:*:*:*:*:*
ciscocisco_ios_xe_software16.11cpe:2.3:a:cisco:cisco_ios_xe_software:16.11:*:*:*:*:*:*:*
ciscocisco_ios_xe_software17.2cpe:2.3:a:cisco:cisco_ios_xe_software:17.2:*:*:*:*:*:*:*
ciscocisco_ios_xe_softwareanycpe:2.3:a:cisco:cisco_ios_xe_software:any:*:*:*:*:*:*:*
ciscoios_xe_sd-wananycpe:2.3:o:cisco:ios_xe_sd-wan:any:*:*:*:*:*:*:*
ciscocisco_ios_xe_software16.9.1cpe:2.3:a:cisco:cisco_ios_xe_software:16.9.1:*:*:*:*:*:*:*
ciscocisco_ios_xe_software16.9.2cpe:2.3:a:cisco:cisco_ios_xe_software:16.9.2:*:*:*:*:*:*:*
ciscocisco_ios_xe_software16.9.1acpe:2.3:a:cisco:cisco_ios_xe_software:16.9.1a:*:*:*:*:*:*:*
ciscocisco_ios_xe_software16.9.1bcpe:2.3:a:cisco:cisco_ios_xe_software:16.9.1b:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	cisco_ios_xe_software	16.9	cpe:2.3:a:cisco:cisco_ios_xe_software:16.9:::::::*
cisco	cisco_ios_xe_software	16.10	cpe:2.3:a:cisco:cisco_ios_xe_software:16.10:::::::*
cisco	cisco_ios_xe_software	16.11	cpe:2.3:a:cisco:cisco_ios_xe_software:16.11:::::::*
cisco	cisco_ios_xe_software	17.2	cpe:2.3:a:cisco:cisco_ios_xe_software:17.2:::::::*
cisco	cisco_ios_xe_software	any	cpe:2.3:a:cisco:cisco_ios_xe_software:any:::::::*
cisco	ios_xe_sd-wan	any	cpe:2.3:o:cisco:ios_xe_sd-wan:any:::::::*
cisco	cisco_ios_xe_software	16.9.1	cpe:2.3:a:cisco:cisco_ios_xe_software:16.9.1:::::::*
cisco	cisco_ios_xe_software	16.9.2	cpe:2.3:a:cisco:cisco_ios_xe_software:16.9.2:::::::*
cisco	cisco_ios_xe_software	16.9.1a	cpe:2.3:a:cisco:cisco_ios_xe_software:16.9.1a:::::::*
cisco	cisco_ios_xe_software	16.9.1b	cpe:2.3:a:cisco:cisco_ios_xe_software:16.9.1b:::::::*