CVE-2009-0471: CSRF
Cross-site request forgery (CSRF) vulnerability in the HTTP server in Cisco IOS 12.4(23) allows remote attackers to execute arbitrary commands, as demonstrated by executing the hostname command with a level/15/configure/-/hostname request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the Cisco IOS HTTP server (management web interface) to trusted IP addresses or networks using firewall rules or IOS ACLs; block or drop HTTP access from untrusted or Internet sources.
- Operational
Inventory network devices and identify all Cisco IOS devices running version 12.4(23).
- Operational
Review HTTP server/access logs on Cisco IOS devices for requests matching '/level/15/configure/-/hostname' or other unexpected '/configure' paths. If evidence of exploitation is found, immediately isolate the device from the network, rotate administrative credentials and keys, and restore or reimage from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0471?
The severity of CVE-2009-0471 is classified as high due to the potential for remote command execution via CSRF.
How do I fix CVE-2009-0471?
To mitigate CVE-2009-0471, update to a patched version of Cisco IOS that addresses this vulnerability.
What specific software versions are affected by CVE-2009-0471?
CVE-2009-0471 specifically affects Cisco IOS version 12.4(23).
What type of attack does CVE-2009-0471 involve?
CVE-2009-0471 involves a cross-site request forgery (CSRF) attack that can execute arbitrary commands.
Can CVE-2009-0471 impact network security?
Yes, CVE-2009-0471 can significantly compromise network security by allowing unauthorized execution of commands on affected systems.