cisco-sa-20170927-restapi: Cisco IOS XE Software Web UI REST API Authentication Bypass Vulnerability

Published Sep 27, 2017

Updated

A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication to the REST API of the web UI of the affected software. The vulnerability is due to insufficient input validation for the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious API request to an affected device. A successful exploit could allow the attacker to bypass authentication and gain access to the web UI of the affected software. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-restapi This advisory is part of the September 27, 2017, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2017 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.

Credit

This vulnerability was reported to Cisco by an internal testing team.

Affected Software

1 affected component

Cisco IOS XE Software

Event History

Sep 27, 2017

Advisory Published

04:00 PM

Data Sourced

04:00 PM

DescriptionSeverityWeaknessAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2017-12229

Frequently Asked Questions

What is the severity of Cisco SA 20170927 REST API?

The severity of Cisco SA 20170927 REST API is considered high due to the potential for unauthorized access.

How do I fix Cisco SA 20170927 REST API?

To fix Cisco SA 20170927 REST API, apply the latest security patches provided by Cisco for affected versions.

What are the potential impacts of Cisco SA 20170927 REST API?

The potential impacts include unauthorized access to the REST API, allowing attackers to perform actions without authentication.

Which Cisco IOS XE Software versions are affected by Cisco SA 20170927 REST API?

All versions of Cisco IOS XE Software prior to the release of the security patches are affected by Cisco SA 20170927 REST API.

Can Cisco SA 20170927 REST API be exploited remotely?

Yes, Cisco SA 20170927 REST API can be exploited remotely by an unauthenticated attacker.