CVE-2019-1755: Cisco IOS XE Software Command Injection Vulnerability

Published Mar 28, 2019

Updated

A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker could exploit this vulnerability by submitting crafted HTTP requests to the targeted application. A successful exploit could allow the attacker to execute arbitrary commands on the affected device.

Affected Software

38 affected components

Cisco IOS XE=3.2.0ja

Cisco IOS XE=3.6.10e

Cisco IOS XE=16.1.1

Cisco IOS XE=16.1.2

Cisco IOS XE=16.1.3

Cisco IOS XE=16.2.1

Cisco IOS XE=16.2.2

Cisco IOS XE=16.3.1

Cisco IOS XE=16.3.1a

Cisco IOS XE=16.3.2

Cisco IOS XE=16.3.3

Cisco IOS XE=16.3.4

Cisco IOS XE=16.3.5

Cisco IOS XE=16.3.5b

Cisco IOS XE=16.3.6

Cisco IOS XE=16.3.7

Cisco IOS XE=16.3.8

Cisco IOS XE=16.4.1

Cisco IOS XE=16.4.2

Cisco IOS XE=16.4.3

Cisco IOS XE=16.5.1

Cisco IOS XE=16.5.1a

Cisco IOS XE=16.5.1b

Cisco IOS XE=16.5.2

Cisco IOS XE=16.5.3

Cisco IOS XE=16.6.1

Cisco IOS XE=16.6.2

Cisco IOS XE=16.6.3

Cisco IOS XE=16.7.1

Cisco IOS XE=16.7.1a

Cisco IOS XE=16.7.1b

Cisco IOS XE=16.8.1

Cisco IOS XE=16.8.1a

Cisco IOS XE=16.8.1b

Cisco IOS XE=16.8.1c

Cisco IOS XE=16.8.1d

Cisco IOS XE=16.8.1e

Cisco IOS XE=16.8.1s

Remediation

Patch Available

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-cmdinj

Event History

Mar 28, 2019

CVE Published

via MITRE·12:15 AM

Data Sourced

via MITRE·12:15 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:29 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-1755?

CVE-2019-1755 has a high severity rating due to its ability to allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands.

How do I fix CVE-2019-1755?

To fix CVE-2019-1755, upgrade to a version of Cisco IOS XE that is not affected by this vulnerability.

What products are affected by CVE-2019-1755?

CVE-2019-1755 affects multiple versions of Cisco IOS XE including versions 3.2.0ja, 3.6.10e, and 16.1.x through 16.8.x.

What type of vulnerability is CVE-2019-1755?

CVE-2019-1755 is a command injection vulnerability occurring in the Web Services Management Agent function of Cisco IOS XE.

Can CVE-2019-1755 lead to unauthorized access?

Yes, CVE-2019-1755 could allow an attacker to execute commands with privilege level 15, potentially leading to unauthorized access.