CVE-2019-1753: Cisco IOS XE Software Privilege Escalation Vulnerability
First published: Thu Mar 28 2019(Updated: )
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent (WSMA) functions. An attacker could exploit this vulnerability by submitting a malicious payload to the affected device's web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE | =3.2.0ja | |
| Cisco IOS XE | =3.6.10e | |
| Cisco IOS XE | =16.6.1 | |
| Cisco IOS XE | =16.6.2 | |
| Cisco IOS XE | =16.6.3 | |
| Cisco IOS XE | =16.7.1 | |
| Cisco IOS XE | =16.7.1a | |
| Cisco IOS XE | =16.7.1b | |
| Cisco IOS XE | =16.8.1 | |
| Cisco IOS XE | =16.8.1a | |
| Cisco IOS XE | =16.8.1b | |
| Cisco IOS XE | =16.8.1c | |
| Cisco IOS XE | =16.8.1d | |
| Cisco IOS XE | =16.8.1e | |
| Cisco IOS XE | =16.8.1s | |
| =3.2.0ja | ||
| =3.6.10e | ||
| =16.6.1 | ||
| =16.6.2 | ||
| =16.6.3 | ||
| =16.7.1 | ||
| =16.7.1a | ||
| =16.7.1b | ||
| =16.8.1 | ||
| =16.8.1a | ||
| =16.8.1b | ||
| =16.8.1c | ||
| =16.8.1d | ||
| =16.8.1e | ||
| =16.8.1s |
Remedy
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-pe
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-1753?
CVE-2019-1753 has a medium severity rating due to the potential for unauthorized execution of privileged commands by unprivileged users.
How do I fix CVE-2019-1753?
To remediate CVE-2019-1753, update your Cisco IOS XE software to a version that is not affected by this vulnerability.
Who is affected by CVE-2019-1753?
CVE-2019-1753 affects authenticated users with level 1 privilege on specific versions of Cisco IOS XE.
What types of attacks can exploit CVE-2019-1753?
CVE-2019-1753 can be exploited by remote attackers to run privileged commands via the web UI without proper authorization.
When was CVE-2019-1753 disclosed?
CVE-2019-1753 was disclosed in March 2019 following the release of a Cisco security advisory.
- collector/nvd-index
- agent/references
- agent/type
- agent/title
- agent/remedy
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/cisco
- canonical/cisco ios xe
- version/cisco ios xe/3.2.0ja
- version/cisco ios xe/3.6.10e
- version/cisco ios xe/16.6.1
- version/cisco ios xe/16.6.2
- version/cisco ios xe/16.6.3
- version/cisco ios xe/16.7.1
- version/cisco ios xe/16.7.1a
- version/cisco ios xe/16.7.1b
- version/cisco ios xe/16.8.1
- version/cisco ios xe/16.8.1a
- version/cisco ios xe/16.8.1b
- version/cisco ios xe/16.8.1c
- version/cisco ios xe/16.8.1d
- version/cisco ios xe/16.8.1e
- version/cisco ios xe/16.8.1s