cisco-sa-20180926-catalyst6800: Cisco Catalyst 6800 Series Switches ROM Monitor Software Secure Boot Bypass Vulnerability
First published: Wed Sep 26 2018(Updated: )
A vulnerability in Cisco IOS ROM Monitor (ROMMON) Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, local attacker to bypass Cisco Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to the presence of a hidden command in the affected software. An attacker could exploit this vulnerability by connecting to an affected device via the console, forcing the device into ROMMON mode, and writing a malicious pattern to a specific memory address on the device. A successful exploit could allow the attacker to bypass signature validation checks by Cisco Secure Boot technology and load a compromised software image on the affected device. A compromised software image is any software image that has not been digitally signed by Cisco. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-catalyst6800
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS ROM Monitor | ||
| Cisco Catalyst 6800 Series Switches |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20180926-catalyst6800?
The severity of cisco-sa-20180926-catalyst6800 is high, as it allows local attackers to bypass secure boot validation.
How do I fix cisco-sa-20180926-catalyst6800?
To fix cisco-sa-20180926-catalyst6800, upgrade the Cisco IOS ROM Monitor software to a version that addresses the vulnerability.
Who is affected by cisco-sa-20180926-catalyst6800?
Cisco Catalyst 6800 Series Switches running affected versions of Cisco IOS ROM Monitor are vulnerable to cisco-sa-20180926-catalyst6800.
What types of attacks can exploit cisco-sa-20180926-catalyst6800?
An unauthenticated local attacker can exploit cisco-sa-20180926-catalyst6800 to load a compromised software image onto an affected device.
Is cisco-sa-20180926-catalyst6800 remotely exploitable?
No, cisco-sa-20180926-catalyst6800 is not remotely exploitable as it requires local access to the device.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios rom monitor
- canonical/cisco catalyst 6800 series switches