CVE-2020-3219: Cisco IOS XE Software Web UI Command Injection Vulnerability

Published Jun 3, 2020

Updated

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by submitting crafted input to the web UI. A successful exploit could allow an attacker to execute arbitrary commands with administrative privileges on an affected device.

Affected Software

92 affected components

Cisco IOS XE=16.1.1

Cisco IOS XE=16.1.2

Cisco IOS XE=16.1.3

Cisco IOS XE=16.2.1

Cisco IOS XE=16.2.2

Cisco IOS XE=16.3.1

Cisco IOS XE=16.3.1a

Cisco IOS XE=16.3.2

Cisco IOS XE=16.3.3

Cisco IOS XE=16.3.4

Cisco IOS XE=16.3.5

Cisco IOS XE=16.3.5b

Cisco IOS XE=16.3.6

Cisco IOS XE=16.3.7

Cisco IOS XE=16.3.8

Cisco IOS XE=16.3.9

Cisco IOS XE=16.3.10

Cisco IOS XE=16.4.1

Cisco IOS XE=16.4.2

Cisco IOS XE=16.4.3

Cisco IOS XE=16.5.1

Cisco IOS XE=16.5.1a

Cisco IOS XE=16.5.1b

Cisco IOS XE=16.5.2

Cisco IOS XE=16.5.3

Cisco IOS XE=16.6.1

Cisco IOS XE=16.6.2

Cisco IOS XE=16.6.3

Cisco IOS XE=16.6.4

Cisco IOS XE=16.6.4a

Cisco IOS XE=16.6.4s

Cisco IOS XE=16.6.5

Cisco IOS XE=16.6.5a

Cisco IOS XE=16.6.5b

Cisco IOS XE=16.6.6

Cisco IOS XE=16.6.7

Cisco IOS XE=16.6.7a

Cisco IOS XE=16.7.1

Cisco IOS XE=16.7.1a

Cisco IOS XE=16.7.1b

Cisco IOS XE=16.7.2

Cisco IOS XE=16.7.3

Cisco IOS XE=16.7.4

Cisco IOS XE=16.8.1

Cisco IOS XE=16.8.1a

Cisco IOS XE=16.8.1b

Cisco IOS XE=16.8.1c

Cisco IOS XE=16.8.1d

Cisco IOS XE=16.8.1e

Cisco IOS XE=16.8.1s

Cisco IOS XE=16.8.2

Cisco IOS XE=16.8.3

Cisco IOS XE=16.9.1

Cisco IOS XE=16.9.1a

Cisco IOS XE=16.9.1b

Cisco IOS XE=16.9.1c

Cisco IOS XE=16.9.1d

Cisco IOS XE=16.9.1s

Cisco IOS XE=16.9.2

Cisco IOS XE=16.9.2a

Cisco IOS XE=16.9.2s

Cisco IOS XE=16.9.3

Cisco IOS XE=16.9.3a

Cisco IOS XE=16.9.3h

Cisco IOS XE=16.9.3s

Cisco IOS XE=16.9.4

Cisco IOS XE=16.9.4c

Cisco IOS XE=16.10.1

Cisco IOS XE=16.10.1a

Cisco IOS XE=16.10.1b

Cisco IOS XE=16.10.1c

Cisco IOS XE=16.10.1d

Cisco IOS XE=16.10.1e

Cisco IOS XE=16.10.1f

Cisco IOS XE=16.10.1g

Cisco IOS XE=16.10.1s

Cisco IOS XE=16.10.2

Cisco IOS XE=16.10.3

Cisco IOS XE=16.11.1

Cisco IOS XE=16.11.1a

Cisco IOS XE=16.11.1b

Cisco IOS XE=16.11.1c

Cisco IOS XE=16.11.1s

Cisco IOS XE=16.11.2

Cisco IOS XE=16.12.1

Cisco IOS XE=16.12.1a

Cisco IOS XE=16.12.1c

Cisco IOS XE=16.12.1s

Cisco IOS XE=16.12.1t

Cisco IOS XE=16.12.1w

Cisco IOS XE=16.12.1x

Cisco IOS XE=16.12.1y

Remediation

Patch Available

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj2-fOnjk2LD

Event History

Jun 3, 2020

CVE Published

via MITRE·05:41 PM

Data Sourced

via MITRE·05:41 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-3219?

CVE-2020-3219 has a critical severity rating that allows authenticated attackers to execute arbitrary commands on affected Cisco IOS XE devices.

How do I fix CVE-2020-3219?

To fix CVE-2020-3219, apply the latest patches released by Cisco for the affected IOS XE versions.

What versions of Cisco IOS XE are affected by CVE-2020-3219?

CVE-2020-3219 affects Cisco IOS XE versions 16.1.1 through 16.12.1y.

Are there any workarounds for CVE-2020-3219?

No specific workarounds have been provided for CVE-2020-3219; updating to fixed versions is recommended.

Who is impacted by CVE-2020-3219?

Organizations using the affected Cisco IOS XE versions are at risk of exploitation through CVE-2020-3219.