CVE-2019-1745: Cisco IOS XE Software Command Injection Vulnerability

Published Mar 27, 2019

Updated

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected commands. An exploit could allow the attacker to gain root privileges on the affected device.

Affected Software

155 affected components

Cisco IOS XE=3.6.10e

Cisco IOS XE=3.10.0s

Cisco IOS XE=3.10.1s

Cisco IOS XE=3.10.2as

Cisco IOS XE=3.10.2s

Cisco IOS XE=3.10.2ts

Cisco IOS XE=3.10.3s

Cisco IOS XE=3.10.4s

Cisco IOS XE=3.10.5s

Cisco IOS XE=3.10.6s

Cisco IOS XE=3.10.7s

Cisco IOS XE=3.10.8as

Cisco IOS XE=3.10.8s

Cisco IOS XE=3.10.9s

Cisco IOS XE=3.10.10s

Cisco IOS XE=3.11.0s

Cisco IOS XE=3.11.1s

Cisco IOS XE=3.11.2s

Cisco IOS XE=3.11.3s

Cisco IOS XE=3.11.4s

Cisco IOS XE=3.12.0as

Cisco IOS XE=3.12.0s

Cisco IOS XE=3.12.1s

Cisco IOS XE=3.12.2s

Cisco IOS XE=3.12.3s

Cisco IOS XE=3.12.4s

Cisco IOS XE=3.13.0as

Cisco IOS XE=3.13.0s

Cisco IOS XE=3.13.1s

Cisco IOS XE=3.13.2as

Cisco IOS XE=3.13.2s

Cisco IOS XE=3.13.3s

Cisco IOS XE=3.13.4s

Cisco IOS XE=3.13.5as

Cisco IOS XE=3.13.5s

Cisco IOS XE=3.13.6as

Cisco IOS XE=3.13.6bs

Cisco IOS XE=3.13.6s

Cisco IOS XE=3.13.7as

Cisco IOS XE=3.13.7s

Cisco IOS XE=3.13.8s

Cisco IOS XE=3.13.9s

Cisco IOS XE=3.13.10s

Cisco IOS XE=3.14.0s

Cisco IOS XE=3.14.1s

Cisco IOS XE=3.14.2s

Cisco IOS XE=3.14.3s

Cisco IOS XE=3.14.4s

Cisco IOS XE=3.15.0s

Cisco IOS XE=3.15.1cs

Cisco IOS XE=3.15.1s

Cisco IOS XE=3.15.2s

Cisco IOS XE=3.15.3s

Cisco IOS XE=3.15.4s

Cisco IOS XE=3.16.0as

Cisco IOS XE=3.16.0bs

Cisco IOS XE=3.16.0cs

Cisco IOS XE=3.16.0s

Cisco IOS XE=3.16.1as

Cisco IOS XE=3.16.1s

Cisco IOS XE=3.16.2as

Cisco IOS XE=3.16.2bs

Cisco IOS XE=3.16.2s

Cisco IOS XE=3.16.3as

Cisco IOS XE=3.16.3s

Cisco IOS XE=3.16.4as

Cisco IOS XE=3.16.4bs

Cisco IOS XE=3.16.4cs

Cisco IOS XE=3.16.4ds

Cisco IOS XE=3.16.4es

Cisco IOS XE=3.16.4gs

Cisco IOS XE=3.16.4s

Cisco IOS XE=3.16.5as

Cisco IOS XE=3.16.5bs

Cisco IOS XE=3.16.5s

Cisco IOS XE=3.16.6bs

Cisco IOS XE=3.16.6s

Cisco IOS XE=3.16.7as

Cisco IOS XE=3.16.7bs

Cisco IOS XE=3.16.7s

Cisco IOS XE=3.16.8s

Cisco IOS XE=3.17.0s

Cisco IOS XE=3.17.1as

Cisco IOS XE=3.17.1s

Cisco IOS XE=3.17.3s

Cisco IOS XE=3.17.4s

Cisco IOS XE=3.18.0as

Cisco IOS XE=3.18.0s

Cisco IOS XE=3.18.0sp

Cisco IOS XE=3.18.1asp

Cisco IOS XE=3.18.1bsp

Cisco IOS XE=3.18.1csp

Cisco IOS XE=3.18.1gsp

Cisco IOS XE=3.18.1hsp

Cisco IOS XE=3.18.1isp

Cisco IOS XE=3.18.1s

Cisco IOS XE=3.18.1sp

Cisco IOS XE=3.18.2asp

Cisco IOS XE=3.18.2s

Cisco IOS XE=3.18.2sp

Cisco IOS XE=3.18.3asp

Cisco IOS XE=3.18.3bsp

Cisco IOS XE=3.18.3s

Cisco IOS XE=3.18.3sp

Cisco IOS XE=3.18.4s

Cisco IOS XE=3.18.4sp

Cisco IOS XE=3.18.5sp

Cisco IOS XE=16.1.1

Cisco IOS XE=16.1.2

Cisco IOS XE=16.1.3

Cisco IOS XE=16.2.1

Cisco IOS XE=16.2.2

Cisco IOS XE=16.3.1

Cisco IOS XE=16.3.1a

Cisco IOS XE=16.3.2

Cisco IOS XE=16.3.3

Cisco IOS XE=16.3.4

Cisco IOS XE=16.3.5

Cisco IOS XE=16.3.5b

Cisco IOS XE=16.3.6

Cisco IOS XE=16.3.7

Cisco IOS XE=16.4.1

Cisco IOS XE=16.4.2

Cisco IOS XE=16.4.3

Cisco IOS XE=16.5.1

Cisco IOS XE=16.5.1a

Cisco IOS XE=16.5.1b

Cisco IOS XE=16.5.2

Cisco IOS XE=16.5.3

Cisco IOS XE=16.6.1

Cisco IOS XE=16.6.2

Cisco IOS XE=16.6.3

Cisco IOS XE=16.6.4

Cisco IOS XE=16.6.4a

Cisco IOS XE=16.6.4s

Cisco IOS XE=16.7.1

Cisco IOS XE=16.7.1a

Cisco IOS XE=16.7.1b

Cisco IOS XE=16.7.2

Cisco IOS XE=16.8.1

Cisco IOS XE=16.8.1a

Cisco IOS XE=16.8.1b

Cisco IOS XE=16.8.1c

Cisco IOS XE=16.8.1d

Cisco IOS XE=16.8.1e

Cisco IOS XE=16.8.1s

Cisco IOS XE=16.8.2

Cisco IOS XE=16.9.1

Cisco IOS XE=16.9.1a

Cisco IOS XE=16.9.1b

Cisco IOS XE=16.9.1c

Cisco IOS XE=16.9.1d

Cisco IOS XE=16.9.1s

Cisco IOS XE=16.9.2

Cisco IOS XE=16.9.2a

Remediation

Patch Available

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-xecmd

Event History

Mar 27, 2019

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

DescriptionSeverityWeakness

Mar 28, 2019

Data Sourced

via NVD·12:29 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-1745?

CVE-2019-1745 has been classified with a critical severity rating due to its impact on the vulnerable systems.

How do I fix CVE-2019-1745?

To fix CVE-2019-1745, update to the latest Cisco IOS XE Software version that contains the patches for this vulnerability.

Who is affected by CVE-2019-1745?

CVE-2019-1745 affects Cisco IOS XE Software versions listed in the specified vulnerability advisory.

What can an attacker do with CVE-2019-1745?

An attacker exploiting CVE-2019-1745 could inject arbitrary commands that are executed with elevated privileges on the affected system.

Is there a workaround for CVE-2019-1745?

Currently, the best practice to mitigate CVE-2019-1745 is to apply the available software updates as no workaround is provided.