cisco-sa-20180606-aaa: Cisco IOS XE Software Authentication, Authorization, and Accounting Login Authentication Remote Code Execution Vulnerability
First published: Wed Jun 06 2018(Updated: )
A vulnerability in the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device or cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect memory operations that the affected software performs when the software parses a username during login authentication. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device or cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-aaa
Credit: This vulnerability was found during the resolution a Cisco TAC support case
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20180606-aaa?
The cisco-sa-20180606-aaa vulnerability has a critical severity level due to its potential to allow arbitrary code execution.
How do I fix cisco-sa-20180606-aaa?
To fix cisco-sa-20180606-aaa, apply the latest patches and updates provided for the affected Cisco IOS XE Software.
Who is affected by cisco-sa-20180606-aaa?
Any organizations using vulnerable versions of Cisco IOS XE Software are affected by the cisco-sa-20180606-aaa vulnerability.
What kind of attacks can exploit cisco-sa-20180606-aaa?
An unauthenticated remote attacker can exploit cisco-sa-20180606-aaa to execute arbitrary code or cause a denial of service.
Is there a workaround for cisco-sa-20180606-aaa?
Currently, disabling the AAA security services feature may serve as a temporary workaround for cisco-sa-20180606-aaa.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/title
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe