CVE-2018-0195
First published: Wed Mar 28 2018(Updated: )
A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious request to an affected device via the REST API. A successful exploit could allow the attacker to selectively bypass authorization checks for the REST API of the affected software and use the API to perform privileged actions on an affected device. Cisco Bug IDs: CSCuz56428.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Software | <16.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0195?
CVE-2018-0195 has been assigned a critical severity rating due to its potential for unauthorized privileged access.
How do I fix CVE-2018-0195?
To fix CVE-2018-0195, update your Cisco IOS XE Software to a version above 16.2.2 that contains the necessary security patches.
Who is affected by CVE-2018-0195?
CVE-2018-0195 affects devices running Cisco IOS XE Software versions prior to 16.2.2.
What types of attacks can occur due to CVE-2018-0195?
An attacker exploiting CVE-2018-0195 can perform unauthorized privileged actions via the affected device's REST API.
Is CVE-2018-0195 remote or local?
CVE-2018-0195 allows remote attackers to exploit the vulnerability without physical access to the affected device.
- agent/references
- agent/type
- agent/author
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe