CVE-2019-12671: Cisco IOS XE Software Consent Token Bypass Vulnerability
First published: Wed Sep 25 2019(Updated: )
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS). The vulnerability is due to insufficient enforcement of the consent token in authorizing shell access. An attacker could exploit this vulnerability by authenticating to the CLI and requesting shell access on an affected device. A successful exploit could allow the attacker to gain shell access on the affected device and execute commands on the underlying OS.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Web UI | =16.11.1 | |
| Cisco IOS XE Web UI | =16.11.1-a | |
| Cisco 4321/k9-rf Integrated Services Router | ||
| Cisco 4321/k9-ws Integrated Services Router | ||
| Cisco 4321 Integrated Services Router | ||
| Cisco 4331/k9-rf Integrated Services Router | ||
| Cisco 4331/k9-ws Integrated Services Router | ||
| Cisco 4331 Integrated Services Router | ||
| Cisco 4351/k9-rf Integrated Services Router | ||
| Cisco 4351/k9 Integrated Services Router | ||
| Cisco 4351/k9 Integrated Services Router | ||
| Cisco ASR 1001-HX | ||
| Cisco ASR 1001-HX-RF | ||
| Cisco ASR 1001-X | ||
| Cisco ASR 1001-X | ||
| Cisco ASR 1001-X | ||
| Cisco ASR 1002-HX | ||
| Cisco ASR 1002-HX | ||
| Cisco ASR 1002-HX | ||
| Cisco ASR 1002-X | ||
| Cisco ASR 1002-X | ||
| Cisco ASR 1002-X | ||
| Cisco c1117-4p | ||
| Cisco c1117-4p | ||
| Cisco C1117-4P LTEA | ||
| Cisco ENCS 5412/K9 | ||
| Cisco ENCS 5412/K9 | ||
| Cisco SASR 1000 Series Software Release 16.10 | ||
| Cisco SASR 1K2XUC MK9 16.10 | ||
| Cisco SASR 1000 Series Software Release 16.10 | ||
| Cisco 1100 Series Integrated Services Router |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-12671?
CVE-2019-12671 is a vulnerability in the CLI of Cisco IOS XE Software that allows an authenticated local attacker to gain shell access on an affected device and execute commands on the underlying OS.
How severe is CVE-2019-12671?
CVE-2019-12671 has a severity rating of 7.8 out of 10, indicating a high severity.
How can an attacker exploit CVE-2019-12671?
An attacker can exploit CVE-2019-12671 by leveraging insufficient enforcement of the consent token in authorizing shell access on the affected device.
Which software versions are affected by CVE-2019-12671?
Cisco IOS XE versions 16.11.1 and 16.11.1-a are affected by CVE-2019-12671.
How can I protect my device from CVE-2019-12671?
To protect your device from CVE-2019-12671, Cisco recommends updating to a fixed software release as mentioned in the Cisco Security Advisory.
- agent/weakness
- agent/type
- agent/author
- agent/title
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe web ui
- version/cisco ios xe web ui/16.11.1
- version/cisco ios xe web ui/16.11.1-a
- canonical/cisco 4321/k9-rf integrated services router
- canonical/cisco 4321/k9-ws integrated services router
- canonical/cisco 4321 integrated services router
- canonical/cisco 4331/k9-rf integrated services router
- canonical/cisco 4331/k9-ws integrated services router
- canonical/cisco 4331 integrated services router
- canonical/cisco 4351/k9-rf integrated services router
- canonical/cisco 4351/k9 integrated services router
- canonical/cisco asr 1001-hx
- canonical/cisco asr 1001-hx-rf
- canonical/cisco asr 1001-x
- canonical/cisco asr 1002-hx
- canonical/cisco asr 1002-x
- canonical/cisco c1117-4p
- canonical/cisco c1117-4p ltea
- canonical/cisco encs 5412/k9
- canonical/cisco sasr 1000 series software release 16.10
- canonical/cisco sasr 1k2xuc mk9 16.10
- canonical/cisco 1100 series integrated services router