Multiple vulnerabilities in Cisco IOS XE Software

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU28565

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-3229

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to incorrect handling of Role Based Access Control (RBAC) functionality for the administration GUI. A remote authenticated attacker can send a modified HTTP request and execute CLI commands or configuration changes with elevated privileges.

This vulnerability affects the following products if they are running affected release of Cisco IOS XE Software: 

• Cisco Integrated Services Virtual Router
• Cisco ASR 1000 Series Aggregation Services Routers
• Cisco Catalyst 3850 Series Switches
• Cisco Catalyst 3650 Series Switches
• Cisco 1000 Series Integrated Services Routers
• Cisco Catalyst 9300 Series Switches
• Cisco Catalyst 9500 Series Switches
• Cisco Catalyst 9200 Series Switches
• Cisco Catalyst 9800 Series Wireless Controllers

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco IOS XE: 16.6.5

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-PZgQxjfG

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Command Injection

EUVDB-ID: #VU28564

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-3224

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation of specific HTTP requests in the web-based user interface (web UI). A remote authenticated attacker can send a specially crafted HTTP request and execute arbitrary commands on the target system.

This vulnerability affects the following products if they are running affected release of Cisco IOS XE Software: 

• Cisco Catalyst 3850 Series Switches
• Cisco Catalyst 3650 Series Switches
• Cisco Catalyst 9300 Series Switches
• Cisco Catalyst 9500 Series Switches
• Cisco Catalyst 9200 Series Switches

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco IOS XE: Gibraltar 16.11.1

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-zM283Zdw

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Link following

EUVDB-ID: #VU28563

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-3223

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability existd due to insufficient file scope limiting in the web-based user interface (web UI). A remote administrator can create a specific file reference on the filesystem, then access it through the web UI and read arbitrary files from the underlying operating system's filesystem.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco IOS XE: Gibraltar 16.10.1

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-filerd-HngnDYGk

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU28562

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-3222

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the presence of a proxy service at a specific endpoint of the web UI. A remote attacker on the local network can connect to the proxy service and bypass access restrictions on the network by proxying their access request through the management network of the affected device.

This vulnerability affects the following products if they are running affected release of Cisco IOS XE Software: 

• Cisco Catalyst 3850 Series Switches
• Cisco Catalyst 3650 Series Switches
• Cisco Catalyst 9300 Series Switches
• Cisco Catalyst 9500 Series Switches
• Cisco Catalyst 9200 Series Switches

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco IOS XE: Gibraltar 16.11.1

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-unauthprxy-KXXsbWh

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.