CVE-2017-12229
First published: Fri Sep 29 2017(Updated: )
A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to bypass authentication to the REST API of the web UI of the affected software. The vulnerability is due to insufficient input validation for the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious API request to an affected device. A successful exploit could allow the attacker to bypass authentication and gain access to the web UI of the affected software. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, if the HTTP Server feature is enabled for the device. The newly redesigned, web-based administration UI was introduced in the Denali 16.2 Release of Cisco IOS XE Software. This vulnerability does not affect the web-based administration UI in earlier releases of Cisco IOS XE Software. Cisco Bug IDs: CSCuz46036.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE | =3.1.3as | |
| Cisco IOS XE | =3.2.0ja | |
| Cisco IOS XE | =3.2.1xo | |
| Cisco IOS XE | =3.4.7asg | |
| Cisco IOS XE | =3.6.5be | |
| Cisco IOS XE | =3.8.0ex | |
| Cisco IOS XE | =3.18.3vs | |
| Cisco IOS XE | =16.1.1 | |
| Cisco IOS XE | =16.1.2 | |
| Cisco IOS XE | =16.1.3 | |
| Cisco IOS XE | =16.1.3a | |
| Cisco IOS XE | =16.1.4 | |
| Cisco IOS XE | =16.2.1 | |
| Cisco IOS XE | =16.2.2a | |
| Cisco IOS XE | =16.3.1a | |
| Cisco IOS XE | =16.5.1a | |
| Cisco IOS XE | =16.5.1c |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-12229?
The severity of CVE-2017-12229 is rated as critical with a score of 9.8.
How do I fix CVE-2017-12229?
To fix CVE-2017-12229, upgrade to a version of Cisco IOS XE that is not affected.
What causes the vulnerability in CVE-2017-12229?
CVE-2017-12229 is caused by insufficient input validation in the REST API of the Cisco IOS XE web UI.
Who is affected by CVE-2017-12229?
CVE-2017-12229 affects multiple versions of Cisco IOS XE from versions 3.1 to 16.5.
What type of attack can exploit CVE-2017-12229?
CVE-2017-12229 can be exploited by an unauthenticated remote attacker to bypass authentication.
- collector/nvd-index
- vendor/cisco
- product/ios xe
- canonical/cisco ios xe