CVE-2019-1754: Cisco IOS XE Software Privilege Escalation Vulnerability
First published: Thu Mar 28 2019(Updated: )
A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker could exploit this vulnerability by submitting a malicious payload to a specific endpoint in the web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE | =3.2.0ja | |
| Cisco IOS XE | =16.7.1 | |
| Cisco IOS XE | =16.7.1a | |
| Cisco IOS XE | =16.7.1b | |
| Cisco IOS XE | =16.8.1 | |
| Cisco IOS XE | =16.8.1a | |
| Cisco IOS XE | =16.8.1b | |
| Cisco IOS XE | =16.8.1c | |
| Cisco IOS XE | =16.8.1d | |
| Cisco IOS XE | =16.8.1e | |
| Cisco IOS XE | =16.8.1s | |
| Cisco IOS XE | =16.8.2 | |
| Cisco IOS XE | =16.9.1b | |
| Cisco IOS XE | =16.9.1c | |
| Cisco IOS XE | =16.9.1d | |
| Cisco IOS XE | =16.9.1s | |
| =3.2.0ja | ||
| =16.7.1 | ||
| =16.7.1a | ||
| =16.7.1b | ||
| =16.8.1 | ||
| =16.8.1a | ||
| =16.8.1b | ||
| =16.8.1c | ||
| =16.8.1d | ||
| =16.8.1e | ||
| =16.8.1s | ||
| =16.8.2 | ||
| =16.9.1b | ||
| =16.9.1c | ||
| =16.9.1d | ||
| =16.9.1s |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-1754?
The severity of CVE-2019-1754 is considered high due to its potential exploitation by authenticated users to execute privileged commands.
How do I fix CVE-2019-1754?
To fix CVE-2019-1754, update your Cisco IOS XE software to a version that addresses the vulnerability, as outlined in Cisco's security advisory.
What types of systems are affected by CVE-2019-1754?
CVE-2019-1754 affects multiple versions of Cisco IOS XE, specifically versions 3.2.0ja and 16.7.x, 16.8.x, and 16.9.x.
Can CVE-2019-1754 be exploited remotely?
Yes, CVE-2019-1754 can be exploited remotely by an authenticated but unprivileged user through the web UI.
What is the main cause of CVE-2019-1754?
The main cause of CVE-2019-1754 is improper validation of user privileges within the Cisco IOS XE web interface.
- collector/nvd-index
- agent/references
- agent/type
- agent/title
- agent/remedy
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/cisco
- canonical/cisco ios xe
- version/cisco ios xe/3.2.0ja
- version/cisco ios xe/16.7.1
- version/cisco ios xe/16.7.1a
- version/cisco ios xe/16.7.1b
- version/cisco ios xe/16.8.1
- version/cisco ios xe/16.8.1a
- version/cisco ios xe/16.8.1b
- version/cisco ios xe/16.8.1c
- version/cisco ios xe/16.8.1d
- version/cisco ios xe/16.8.1e
- version/cisco ios xe/16.8.1s
- version/cisco ios xe/16.8.2
- version/cisco ios xe/16.9.1b
- version/cisco ios xe/16.9.1c
- version/cisco ios xe/16.9.1d
- version/cisco ios xe/16.9.1s