CVE-2017-3858: Input Validation

Published Mar 22, 2017

Updated

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the affected web page parameter. The user must be authenticated to access the affected parameter. A successful exploit could allow the attacker to execute commands with root privileges. This vulnerability affects Cisco devices running Cisco IOS XE Software Release 16.2.1, if the HTTP Server feature is enabled for the device. The newly redesigned, web-based administration interface was introduced in the Denali 16.2 Release of Cisco IOS XE Software. The web-based administration interface in earlier releases of Cisco IOS XE Software is not affected by this vulnerability. Cisco Bug IDs: CSCuy83069.

Affected Software

2 affected components

Cisco IOS XE=16.2

Cisco IOS XE=16.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CSCuy83069
Configuration
Disable the HTTP Server feature on Cisco IOS XE 16.2.1 devices if you do not require web access, since the vulnerability affects the embedded web administration interface when HTTP Server is enabled.
Cisco IOS XE Software (web-based administration interface / HTTP server) HTTP Server feature = disable (if not required)

Event History

Mar 22, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3858?

The severity of CVE-2017-3858 is considered high due to the potential for remote code execution with root privileges.

How do I fix CVE-2017-3858?

To fix CVE-2017-3858, upgrade to a patched version of Cisco IOS XE Software as recommended in the security advisory.

What systems are affected by CVE-2017-3858?

CVE-2017-3858 affects Cisco IOS XE versions 16.2 and 16.2.1.

What type of attack can exploit CVE-2017-3858?

CVE-2017-3858 can be exploited by an authenticated, remote attacker to inject arbitrary commands.

What are the potential impacts of CVE-2017-3858?

The potential impacts of CVE-2017-3858 include unauthorized command execution and manipulation of system processes.