cisco-sa-webui-cmdinj-zM283Zdw: Cisco IOS XE Software Web UI Command Injection Vulnerability
First published: Wed Jun 03 2020(Updated: )
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to an affected device. The injected commands should require a higher privilege level in order to be executed. The vulnerability is due to insufficient input validation of specific HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a specific web UI endpoint on an affected device. A successful exploit could allow the attacker to inject IOS commands to the affected device, which could allow the attacker to alter the configuration of the device or cause a denial of service (DoS) condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-zM283Zdw This advisory is part of the June 3, 2020, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 23 Cisco Security Advisories that describe 25 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-webui-cmdinj-zM283Zdw?
The severity of cisco-sa-webui-cmdinj-zM283Zdw is classified as high due to the potential for command injection by authenticated users.
How do I fix cisco-sa-webui-cmdinj-zM283Zdw?
To fix cisco-sa-webui-cmdinj-zM283Zdw, ensure you update your Cisco IOS XE Software to the latest patched version provided by Cisco.
What are the risks associated with cisco-sa-webui-cmdinj-zM283Zdw?
The risks associated with cisco-sa-webui-cmdinj-zM283Zdw include unauthorized command execution on affected devices, which can lead to system compromise.
Who is affected by cisco-sa-webui-cmdinj-zM283Zdw?
Any device utilizing the web-based user interface of Cisco IOS XE Software is potentially affected by cisco-sa-webui-cmdinj-zM283Zdw.
What type of attack is cisco-sa-webui-cmdinj-zM283Zdw related to?
cisco-sa-webui-cmdinj-zM283Zdw is related to a command injection attack that can be executed by authenticated users with read-only privileges.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/title
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe