cisco-sa-20190925-ios-gos-auth: Cisco IOx for IOS Software Guest Operating System Unauthorized Access Vulnerability
First published: Wed Sep 25 2019(Updated: )
A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests access to a Guest OS that should be restricted to administrative accounts. An attacker could exploit this vulnerability by authenticating to the Guest OS by using the low-privileged-user credentials. An exploit could allow the attacker to gain unauthorized access to the Guest OS as a root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth This advisory is part of the September 25, 2019, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2019 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | ||
| Cisco IOx |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20190925-ios-gos-auth?
The severity of cisco-sa-20190925-ios-gos-auth is categorized as a medium risk due to potential unauthorized access.
Who is affected by cisco-sa-20190925-ios-gos-auth?
cisco-sa-20190925-ios-gos-auth affects devices running Cisco IOS Software and Cisco IOx.
How do I fix cisco-sa-20190925-ios-gos-auth?
To mitigate cisco-sa-20190925-ios-gos-auth, update the affected Cisco IOS Software and IOx to the latest version.
What causes the vulnerability cisco-sa-20190925-ios-gos-auth?
The cisco-sa-20190925-ios-gos-auth vulnerability is caused by incorrect role-based access control in the IOx application environment.
What can attackers do with cisco-sa-20190925-ios-gos-auth?
Attackers exploiting cisco-sa-20190925-ios-gos-auth can gain unauthorized access to the Guest Operating System running on an affected device.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/title
- agent/weakness
- agent/references
- agent/severity
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios
- canonical/cisco iox