FKIE_CVE-2019-12671

Vulnerability from fkie_nvd - Published: 2019-09-25 21:15 - Updated: 2024-11-21 04:23
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS). The vulnerability is due to insufficient enforcement of the consent token in authorizing shell access. An attacker could exploit this vulnerability by authenticating to the CLI and requesting shell access on an affected device. A successful exploit could allow the attacker to gain shell access on the affected device and execute commands on the underlying OS.
References
psirt@cisco.comhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-ctbypassVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-ctbypassVendor Advisory
Impacted products
Vendor Product Version
cisco ios_xe 16.11.1
cisco ios_xe 16.11.1
cisco 4321\/k9-rf_integrated_services_router -
cisco 4321\/k9-ws_integrated_services_router -
cisco 4321\/k9_integrated_services_router -
cisco 4331\/k9-rf_integrated_services_router -
cisco 4331\/k9-ws_integrated_services_router -
cisco 4331\/k9_integrated_services_router -
cisco 4351\/k9-rf_integrated_services_router -
cisco 4351\/k9-ws_integrated_services_router -
cisco 4351\/k9_integrated_services_router -
cisco asr1001-hx -
cisco asr1001-hx-rf -
cisco asr1001-x -
cisco asr1001-x-rf -
cisco asr1001-x-ws -
cisco asr1002-hx -
cisco asr1002-hx-rf -
cisco asr1002-hx-ws -
cisco asr1002-x -
cisco asr1002-x-rf -
cisco asr1002-x-ws -
cisco c1117-4p -
cisco c1117-4plteea -
cisco c1117-4pltela -
cisco encs5412\/k9 -
cisco encs5412\/k9-rf -
cisco sasr1k1xucmk9-1610 -
cisco sasr1k2xucmk9-1610 -
cisco sasr1khxucmk9-1610 -
cisco sisr1100ucmk9-1610 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:16.11.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E91F8704-6DAD-474A-84EA-04E4AF7BB9B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:ios_xe:16.11.1:a:*:*:*:*:*:*",
              "matchCriteriaId": "A2C32E72-009C-4377-8EF0-5090A64450AF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:4321\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "05C90C43-2D7D-43F8-AD7F-421878909AE2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4321\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "445597DA-7EEC-470D-9A71-BC43A9F7DE5E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4321\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "86049773-C88D-4A26-A0D3-D40F3C312AEC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AB4B7C2-4D45-4267-BCBB-57D36C6104A3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B8A4630-8B21-4994-8EF5-E105593A64E5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4331\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F799DC02-EB06-458C-8545-A174475FE7A2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351\\/k9-rf_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B89FBA68-A8ED-4C5A-916E-A68468F59730",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351\\/k9-ws_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD272E6E-2ED1-4408-8FF7-0B82F9DCBEF8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:4351\\/k9_integrated_services_router:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC278B77-AD63-42AD-B9E8-EE4DE97E27E9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1001-hx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C24227E-9FF6-4757-A342-958CA4B8BF63",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1001-hx-rf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E529335-18D1-4CEC-A8D5-CC1CA33D64F5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1001-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3072DEFA-61D6-413F-97FD-F64C0E90155C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1001-x-rf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9FBFB5C-347B-4F73-93BE-4D3137D8F93A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1001-x-ws:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F040372-CDAD-4AC4-9B7C-BFF9658B6BF2",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1002-hx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C33862F1-652A-4F60-BD3E-A6B3733E56A9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1002-hx-rf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "130205FD-CA31-4E49-B8C4-181840270C70",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1002-hx-ws:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "908A56D8-64AF-4813-9D4D-C429C0603A31",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1002-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "03A2AA1C-7568-4BB6-BBD3-8E03D32CDA1F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1002-x-rf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "53DAF422-7E0B-44EB-AD8D-4643A9711739",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asr1002-x-ws:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F7F661E-335C-4123-9363-E2E5D51846C1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:c1117-4p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E93E05E8-32E9-4441-BA6D-FCDC413979BF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:c1117-4plteea:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EB9CE31-BA5F-4111-881D-EB8546950BA5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:c1117-4pltela:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1693D321-0465-42D9-A947-4A428F836CDD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:encs5412\\/k9:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF3E4DCA-455C-4D93-973C-C613781E6406",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:encs5412\\/k9-rf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "313B08AE-E0ED-43E8-A182-9578CFA1BFD7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:sasr1k1xucmk9-1610:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DBC3978-6CA8-46E3-ADFB-0C67E7BAC5CE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:sasr1k2xucmk9-1610:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "38348475-5EFC-471E-B32A-487967F9D479",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:sasr1khxucmk9-1610:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D01ABAC-C744-4A8B-9DAD-EEA9AC01EA56",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:sisr1100ucmk9-1610:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B354F0C-36C4-492F-BE33-B89042F36876",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS). The vulnerability is due to insufficient enforcement of the consent token in authorizing shell access. An attacker could exploit this vulnerability by authenticating to the CLI and requesting shell access on an affected device. A successful exploit could allow the attacker to gain shell access on the affected device and execute commands on the underlying OS."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la CLI del Software Cisco IOS XE, podr\u00eda permitir a un atacante local autenticado conseguir acceso de shell en un dispositivo afectado y ejecutar comandos sobre el sistema operativo (SO) subyacente. La vulnerabilidad es debido a la aplicaci\u00f3n insuficiente del token de consentimiento en la autorizaci\u00f3n del acceso de shell. Un atacante podr\u00eda explotar esta vulnerabilidad mediante la autenticaci\u00f3n en la CLI y solicitando acceso de shell en un dispositivo afectado. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante conseguir acceso de shell en el dispositivo afectado y ejecutar comandos en el Sistema Operativo subyacente."
    }
  ],
  "id": "CVE-2019-12671",
  "lastModified": "2024-11-21T04:23:19.470",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-09-25T21:15:11.750",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-ctbypass"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-ctbypass"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.