cisco-sa-20170927-pnp: Cisco IOS and IOS XE Software Plug-and-Play PKI API Certificate Validation Vulnerability
First published: Wed Sep 27 2017(Updated: )
A vulnerability in the Cisco Network Plug and Play application of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-pnp This advisory is part of the September 27, 2017, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2017 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.
Credit: This vulnerability was reported to Cisco by an internal testing team.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | ||
| Cisco IOS XE Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20170927-pnp?
The cisco-sa-20170927-pnp vulnerability is classified as critical due to its potential to allow unauthorized access to sensitive data.
How do I fix cisco-sa-20170927-pnp?
To fix cisco-sa-20170927-pnp, ensure that your Cisco IOS Software and Cisco IOS XE Software are updated to the latest versions that address this vulnerability.
Who is affected by cisco-sa-20170927-pnp?
The cisco-sa-20170927-pnp vulnerability affects devices running vulnerable versions of Cisco IOS Software and Cisco IOS XE Software.
What type of attack is possible with cisco-sa-20170927-pnp?
An unauthenticated, remote attacker can exploit cisco-sa-20170927-pnp to gain unauthorized access to sensitive data using an invalid certificate.
What should I do if I am using affected Cisco software for cisco-sa-20170927-pnp?
If you are using affected Cisco software related to cisco-sa-20170927-pnp, upgrade to a patched version as soon as possible to mitigate the risk.
- collector/cisco-advisory
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/title
- agent/severity
- agent/description
- agent/author
- agent/softwarecombine
- agent/tags
- agent/references
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios
- canonical/cisco ios xe software