cisco-sa-20170927-privesc: Cisco IOS XE Software Web UI Privilege Escalation Vulnerability
First published: Wed Sep 27 2017(Updated: )
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using the web UI of the affected software. An attacker could exploit this vulnerability by using the web UI of the affected software to create a new user and then logging into the web UI as the newly created user. A successful exploit could allow the attacker to elevate their privileges on the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-privesc This advisory is part of the September 27, 2017, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2017 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.
Credit: This vulnerability was reported to Cisco by an internal security testing team.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of Cisco-SA-20170927-PRIVESC?
The severity of Cisco-SA-20170927-PRIVESC is categorized as medium due to potential privilege escalation risks.
How do I fix Cisco-SA-20170927-PRIVESC?
To fix Cisco-SA-20170927-PRIVESC, update the affected Cisco IOS XE Software to a version that addresses the privilege escalation vulnerability.
Who is affected by Cisco-SA-20170927-PRIVESC?
Any organization using affected versions of Cisco IOS XE Software with a web-based user interface is at risk of Cisco-SA-20170927-PRIVESC.
What does Cisco-SA-20170927-PRIVESC allow?
Cisco-SA-20170927-PRIVESC allows authenticated remote attackers to elevate their privileges on the affected device.
What causes Cisco-SA-20170927-PRIVESC?
Cisco-SA-20170927-PRIVESC is caused by incorrect default permission settings for new users created through the web UI.
- collector/cisco-advisory
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/title
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe