cisco-sa-tcl-ace-C9KuVKmm: Cisco IOS and IOS XE Software Tcl Arbitrary Code Execution Vulnerability
First published: Wed Jun 03 2020(Updated: )
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to execute arbitrary code on the underlying operating system (OS) with root privileges. The vulnerability is due to insufficient input validation of data passed to the Tcl interpreter. An attacker could exploit this vulnerability by loading malicious Tcl code on an affected device. A successful exploit could allow the attacker to cause memory corruption or execute the code with root privileges on the underlying OS of the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tcl-ace-C9KuVKmm
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | ||
| Cisco IOS XE Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-tcl-ace-C9KuVKmm?
The cisco-sa-tcl-ace-C9KuVKmm vulnerability is classified as a high severity issue.
How do I fix cisco-sa-tcl-ace-C9KuVKmm?
To remediate cisco-sa-tcl-ace-C9KuVKmm, upgrade to a patched version of Cisco IOS Software or Cisco IOS XE Software.
Who is affected by cisco-sa-tcl-ace-C9KuVKmm?
cisco-sa-tcl-ace-C9KuVKmm affects authenticated users with privileged EXEC credentials on Cisco IOS and Cisco IOS XE Software.
What kind of access does cisco-sa-tcl-ace-C9KuVKmm provide to an attacker?
The cisco-sa-tcl-ace-C9KuVKmm vulnerability allows an authenticated attacker to execute arbitrary code with root privileges on the underlying operating system.
Is there a workaround for cisco-sa-tcl-ace-C9KuVKmm?
There are no effective workarounds for the cisco-sa-tcl-ace-C9KuVKmm vulnerability; updating the software is necessary for protection.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/title
- agent/weakness
- agent/references
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios
- canonical/cisco ios xe software