cisco-sa-20170322-xeci: Cisco IOS XE Software HTTP Command Injection Vulnerability
First published: Wed Mar 22 2017(Updated: )
A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the affected web page parameter. The user must be authenticated to access the affected parameter. A successful exploit could allow the attacker to execute commands with root privileges. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-xeci This advisory is part of the March 22, 2017, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes five Cisco Security Advisories that describe five vulnerabilities. All the vulnerabilities have a Security Impact Rating of High. For a complete list of the advisories and links to them, see Cisco Event Response: March 2017 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20170322-xeci?
The severity of cisco-sa-20170322-xeci is high due to the potential for remote command injection with root privileges.
How do I fix cisco-sa-20170322-xeci?
To fix cisco-sa-20170322-xeci, upgrade to the latest version of Cisco IOS XE Software that addresses this vulnerability.
Who is affected by cisco-sa-20170322-xeci?
Cisco IOS XE Software users with web framework access and those who have not implemented sufficient input validation are affected by cisco-sa-20170322-xeci.
What can an attacker do with cisco-sa-20170322-xeci?
An attacker can inject arbitrary commands that execute with root privileges, potentially compromising the system.
Is authentication required to exploit cisco-sa-20170322-xeci?
Yes, an attacker must be authenticated to exploit cisco-sa-20170322-xeci and execute arbitrary commands.
- collector/cisco-advisory
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- agent/title
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe