Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2020-02751

Опубликовано: 03 июн. 2020
Источник: fstec
CVSS3: 8.8
CVSS2: 9
EPSS Низкий

Описание

Уязвимость реализации функции контроля доступа на основе ролей Role Based Access Control (RBAC) операционной системы Cisco IOS XE связана с недостатками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, повысить свои привилегии и выполнить произвольный код

Вендор

Cisco Systems Inc.

Наименование ПО

Cisco IOS XE

Версия ПО

16.5.1 (Cisco IOS XE)
16.3.1a (Cisco IOS XE)
16.5.1a (Cisco IOS XE)
16.2.2 (Cisco IOS XE)
16.3.1 (Cisco IOS XE)
16.3.2 (Cisco IOS XE)
16.3.3 (Cisco IOS XE)
16.3.4 (Cisco IOS XE)
16.3.5 (Cisco IOS XE)
16.3.5b (Cisco IOS XE)
16.4.1 (Cisco IOS XE)
16.6.1 (Cisco IOS XE)
16.6.4 (Cisco IOS XE)
16.7.1b (Cisco IOS XE)
16.4.3 (Cisco IOS XE)
16.7.2 (Cisco IOS XE)
16.3.6 (Cisco IOS XE)
16.4.2 (Cisco IOS XE)
16.5.1b (Cisco IOS XE)
16.5.2 (Cisco IOS XE)
16.5.3 (Cisco IOS XE)
16.6.2 (Cisco IOS XE)
16.6.3 (Cisco IOS XE)
16.7.1 (Cisco IOS XE)
16.7.1a (Cisco IOS XE)
16.8.1 (Cisco IOS XE)
16.8.1s (Cisco IOS XE)
16.9.1b (Cisco IOS XE)
16.3.7 (Cisco IOS XE)
16.6.4s (Cisco IOS XE)
16.6.4a (Cisco IOS XE)
16.8.1b (Cisco IOS XE)
16.8.1a (Cisco IOS XE)
16.8.1c (Cisco IOS XE)
16.8.1d (Cisco IOS XE)
16.8.2 (Cisco IOS XE)
16.8.1e (Cisco IOS XE)
16.9.1 (Cisco IOS XE)
16.9.2 (Cisco IOS XE)
16.9.1a (Cisco IOS XE)
16.9.1s (Cisco IOS XE)
16.9.1c (Cisco IOS XE)
16.9.1d (Cisco IOS XE)
16.9.2a (Cisco IOS XE)
16.7.3 (Cisco IOS XE)
16.10.1 (Cisco IOS XE)
16.7.4 (Cisco IOS XE)
16.8.3 (Cisco IOS XE)
16.9.2s (Cisco IOS XE)
16.9.3h (Cisco IOS XE)
16.3.8 (Cisco IOS XE)
16.6.5 (Cisco IOS XE)
16.10.2 (Cisco IOS XE)
16.3.9 (Cisco IOS XE)
16.6.5a (Cisco IOS XE)
16.6.6 (Cisco IOS XE)
16.6.5b (Cisco IOS XE)
16.9.3 (Cisco IOS XE)
16.9.4 (Cisco IOS XE)
16.9.3s (Cisco IOS XE)
16.9.4c (Cisco IOS XE)
16.10.1a (Cisco IOS XE)
16.10.1b (Cisco IOS XE)
16.10.1s (Cisco IOS XE)
16.10.1e (Cisco IOS XE)
16.10.3 (Cisco IOS XE)
16.11.1 (Cisco IOS XE)
16.11.1a (Cisco IOS XE)
16.11.1b (Cisco IOS XE)
16.11.1s (Cisco IOS XE)
16.11.1c (Cisco IOS XE)
16.12.1y (Cisco IOS XE)
16.10.1c (Cisco IOS XE)
16.10.1d (Cisco IOS XE)
16.10.1f (Cisco IOS XE)
16.10.1g (Cisco IOS XE)
16.3.10 (Cisco IOS XE)
16.6.7 (Cisco IOS XE)
16.6.7a (Cisco IOS XE)
16.6.8 (Cisco IOS XE)
16.9.5 (Cisco IOS XE)
16.9.5f (Cisco IOS XE)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Cisco Systems Inc. Cisco IOS XE 16.5.1
Cisco Systems Inc. Cisco IOS XE 16.3.1a
Cisco Systems Inc. Cisco IOS XE 16.5.1a
Cisco Systems Inc. Cisco IOS XE 16.2.2
Cisco Systems Inc. Cisco IOS XE 16.3.1
Cisco Systems Inc. Cisco IOS XE 16.3.2
Cisco Systems Inc. Cisco IOS XE 16.3.3
Cisco Systems Inc. Cisco IOS XE 16.3.4
Cisco Systems Inc. Cisco IOS XE 16.3.5
Cisco Systems Inc. Cisco IOS XE 16.3.5b
Cisco Systems Inc. Cisco IOS XE 16.4.1
Cisco Systems Inc. Cisco IOS XE 16.6.1
Cisco Systems Inc. Cisco IOS XE 16.6.4
Cisco Systems Inc. Cisco IOS XE 16.7.1b
Cisco Systems Inc. Cisco IOS XE 16.4.3
Cisco Systems Inc. Cisco IOS XE 16.7.2
Cisco Systems Inc. Cisco IOS XE 16.3.6
Cisco Systems Inc. Cisco IOS XE 16.4.2
Cisco Systems Inc. Cisco IOS XE 16.5.1b
Cisco Systems Inc. Cisco IOS XE 16.5.2
Cisco Systems Inc. Cisco IOS XE 16.5.3
Cisco Systems Inc. Cisco IOS XE 16.6.2
Cisco Systems Inc. Cisco IOS XE 16.6.3
Cisco Systems Inc. Cisco IOS XE 16.7.1
Cisco Systems Inc. Cisco IOS XE 16.7.1a
Cisco Systems Inc. Cisco IOS XE 16.8.1
Cisco Systems Inc. Cisco IOS XE 16.8.1s
Cisco Systems Inc. Cisco IOS XE 16.9.1b
Cisco Systems Inc. Cisco IOS XE 16.3.7
Cisco Systems Inc. Cisco IOS XE 16.6.4s
Cisco Systems Inc. Cisco IOS XE 16.6.4a
Cisco Systems Inc. Cisco IOS XE 16.8.1b
Cisco Systems Inc. Cisco IOS XE 16.8.1a
Cisco Systems Inc. Cisco IOS XE 16.8.1c
Cisco Systems Inc. Cisco IOS XE 16.8.1d
Cisco Systems Inc. Cisco IOS XE 16.8.2
Cisco Systems Inc. Cisco IOS XE 16.8.1e
Cisco Systems Inc. Cisco IOS XE 16.9.1
Cisco Systems Inc. Cisco IOS XE 16.9.2
Cisco Systems Inc. Cisco IOS XE 16.9.1a
Cisco Systems Inc. Cisco IOS XE 16.9.1s
Cisco Systems Inc. Cisco IOS XE 16.9.1c
Cisco Systems Inc. Cisco IOS XE 16.9.1d
Cisco Systems Inc. Cisco IOS XE 16.9.2a
Cisco Systems Inc. Cisco IOS XE 16.7.3
Cisco Systems Inc. Cisco IOS XE 16.10.1
Cisco Systems Inc. Cisco IOS XE 16.7.4
Cisco Systems Inc. Cisco IOS XE 16.8.3
Cisco Systems Inc. Cisco IOS XE 16.9.2s
Cisco Systems Inc. Cisco IOS XE 16.9.3h
Cisco Systems Inc. Cisco IOS XE 16.3.8
Cisco Systems Inc. Cisco IOS XE 16.6.5
Cisco Systems Inc. Cisco IOS XE 16.10.2
Cisco Systems Inc. Cisco IOS XE 16.3.9
Cisco Systems Inc. Cisco IOS XE 16.6.5a
Cisco Systems Inc. Cisco IOS XE 16.6.6
Cisco Systems Inc. Cisco IOS XE 16.6.5b
Cisco Systems Inc. Cisco IOS XE 16.9.3
Cisco Systems Inc. Cisco IOS XE 16.9.4
Cisco Systems Inc. Cisco IOS XE 16.9.3s
Cisco Systems Inc. Cisco IOS XE 16.9.4c
Cisco Systems Inc. Cisco IOS XE 16.10.1a
Cisco Systems Inc. Cisco IOS XE 16.10.1b
Cisco Systems Inc. Cisco IOS XE 16.10.1s
Cisco Systems Inc. Cisco IOS XE 16.10.1e
Cisco Systems Inc. Cisco IOS XE 16.10.3
Cisco Systems Inc. Cisco IOS XE 16.11.1
Cisco Systems Inc. Cisco IOS XE 16.11.1a
Cisco Systems Inc. Cisco IOS XE 16.11.1b
Cisco Systems Inc. Cisco IOS XE 16.11.1s
Cisco Systems Inc. Cisco IOS XE 16.11.1c
Cisco Systems Inc. Cisco IOS XE 16.12.1y
Cisco Systems Inc. Cisco IOS XE 16.10.1c
Cisco Systems Inc. Cisco IOS XE 16.10.1d
Cisco Systems Inc. Cisco IOS XE 16.10.1f
Cisco Systems Inc. Cisco IOS XE 16.10.1g
Cisco Systems Inc. Cisco IOS XE 16.3.10
Cisco Systems Inc. Cisco IOS XE 16.6.7
Cisco Systems Inc. Cisco IOS XE 16.6.7a
Cisco Systems Inc. Cisco IOS XE 16.6.8
Cisco Systems Inc. Cisco IOS XE 16.9.5
Cisco Systems Inc. Cisco IOS XE 16.9.5f

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 9)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 8,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-PZgQxjfG

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 73%
0.00751
Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Связанные уязвимости

nvd логотип

CVE-2020-3229

CVSS3: 8.8
nvd
больше 5 лет назад

A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The vulnerability is due to incorrect handling of RBAC for the administration GUI. An attacker could exploit this vulnerability by sending a modified HTTP request to the affected device. An exploit could allow the attacker as a Read-Only user to execute CLI commands or configuration changes as if they were an Admin user.

github логотип

GHSA-gffh-92vm-w5gf

CVSS3: 8.8
github
больше 3 лет назад

A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The vulnerability is due to incorrect handling of RBAC for the administration GUI. An attacker could exploit this vulnerability by sending a modified HTTP request to the affected device. An exploit could allow the attacker as a Read-Only user to execute CLI commands or configuration changes as if they were an Admin user.

EPSS

Процентиль: 73%
0.00751
Низкий

8.8 High

CVSS3

9 Critical

CVSS2