CVE-2019-12643: Cisco REST API Container for IOS XE Software Authentication Bypass Vulnerability
First published: Wed Aug 28 2019(Updated: )
A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on the managed Cisco IOS XE device. The vulnerability is due to an improper check performed by the area of code that manages the REST API authentication service. An attacker could exploit this vulnerability by submitting malicious HTTP requests to the targeted device. A successful exploit could allow the attacker to obtain the token-id of an authenticated user. This token-id could be used to bypass authentication and execute privileged actions through the interface of the REST API virtual service container on the affected Cisco IOS XE device. The REST API interface is not enabled by default and must be installed and activated separately on IOS XE devices. See the Details section for more information.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE | =15.5\(3\)s3.16 | |
| Cisco IOS XE | =16.6.5 | |
| Cisco 4221 Integrated Services Router | ||
| Cisco 4321 Integrated Services Router | ||
| Cisco 4331 Integrated Services Router | ||
| Cisco 4351 Integrated Services Router | ||
| Cisco 4431 Integrated Services Router | ||
| Cisco 4451-x Integrated Services Router | ||
| Cisco Cloud Services Router 1000v |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-12643.
What is the severity of CVE-2019-12643?
The severity of CVE-2019-12643 is critical.
Which software is affected by CVE-2019-12643?
Cisco IOS XE version 15.5(3)s3.16 and version 16.6.5 are affected by CVE-2019-12643.
How can an attacker exploit CVE-2019-12643?
An unauthenticated remote attacker can bypass authentication on a managed Cisco IOS XE device.
How do I fix CVE-2019-12643?
Apply the necessary patch or upgrade to a fixed version of Cisco IOS XE software.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- vendor/cisco
- canonical/cisco ios xe
- version/cisco ios xe/15.5\(3\)s3.16
- version/cisco ios xe/16.6.5
- canonical/cisco 4221 integrated services router
- canonical/cisco 4321 integrated services router
- canonical/cisco 4331 integrated services router
- canonical/cisco 4351 integrated services router
- canonical/cisco 4431 integrated services router
- canonical/cisco 4451-x integrated services router
- canonical/cisco cloud services router 1000v