cisco-sa-20200108-ios-csrf: Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability
First published: Wed Jan 08 2020(Updated: )
A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or reload an affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ios-csrf
Credit: Mehmet Önder Key.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | ||
| Cisco IOS XE Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20200108-ios-csrf?
The cisco-sa-20200108-ios-csrf vulnerability is rated as high due to its potential to allow unauthorized access to system controls.
How do I fix cisco-sa-20200108-ios-csrf?
To mitigate the cisco-sa-20200108-ios-csrf vulnerability, ensure that you apply the latest patches provided by Cisco for your IOS or IOS XE software.
Who is affected by cisco-sa-20200108-ios-csrf?
Devices running Cisco IOS and Cisco IOS XE Software are susceptible to the cisco-sa-20200108-ios-csrf vulnerability.
What kind of attack does cisco-sa-20200108-ios-csrf allow?
The cisco-sa-20200108-ios-csrf vulnerability allows an unauthenticated attacker to perform a cross-site request forgery attack.
Is user authentication required for cisco-sa-20200108-ios-csrf exploitation?
User authentication is not required for exploiting the cisco-sa-20200108-ios-csrf vulnerability, making it particularly critical.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/author
- agent/weakness
- agent/title
- agent/severity
- agent/references
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios
- canonical/cisco ios xe