What is the severity of Cisco SA 20170927 REST API?

The severity of Cisco SA 20170927 REST API is considered high due to the potential for unauthorized access.

How do I fix Cisco SA 20170927 REST API?

To fix Cisco SA 20170927 REST API, apply the latest security patches provided by Cisco for affected versions.

What are the potential impacts of Cisco SA 20170927 REST API?

The potential impacts include unauthorized access to the REST API, allowing attackers to perform actions without authentication.

Which Cisco IOS XE Software versions are affected by Cisco SA 20170927 REST API?

All versions of Cisco IOS XE Software prior to the release of the security patches are affected by Cisco SA 20170927 REST API.

Can Cisco SA 20170927 REST API be exploited remotely?

Yes, Cisco SA 20170927 REST API can be exploited remotely by an unauthenticated attacker.

Vulnerability/
cisco-sa-20170927-restapi

critical

CWE

27/9/2017

cisco-sa-20170927-restapi: Cisco IOS XE Software Web UI REST API Authentication Bypass Vulnerability

First published: Wed Sep 27 2017(Updated: )

A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication to the REST API of the web UI of the affected software. The vulnerability is due to insufficient input validation for the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious API request to an affected device. A successful exploit could allow the attacker to bypass authentication and gain access to the web UI of the affected software. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-restapi This advisory is part of the September 27, 2017, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2017 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.

Credit: This vulnerability was reported to Cisco by an internal testing team.

Affected Software	Affected Version	How to fix
Cisco IOS XE

Never miss a vulnerability like this again

Reference Links

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-restapi (Advisory)

Child vulnerabilities

(Contains the following vulnerabilities)

CVE-2017-12229

Frequently Asked Questions

What is the severity of Cisco SA 20170927 REST API?
The severity of Cisco SA 20170927 REST API is considered high due to the potential for unauthorized access.
How do I fix Cisco SA 20170927 REST API?
To fix Cisco SA 20170927 REST API, apply the latest security patches provided by Cisco for affected versions.
What are the potential impacts of Cisco SA 20170927 REST API?
The potential impacts include unauthorized access to the REST API, allowing attackers to perform actions without authentication.
Which Cisco IOS XE Software versions are affected by Cisco SA 20170927 REST API?
All versions of Cisco IOS XE Software prior to the release of the security patches are affected by Cisco SA 20170927 REST API.
Can Cisco SA 20170927 REST API be exploited remotely?
Yes, Cisco SA 20170927 REST API can be exploited remotely by an unauthenticated attacker.

collector/cisco-advisory
agent/type
agent/event
agent/last-modified-date
agent/first-publish-date
agent/severity
agent/title
agent/weakness
agent/references
agent/author
agent/description
agent/softwarecombine
agent/tags
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/cisco
canonical/cisco ios xe