Cisco Clears IOS XE Software Web UI Hole

Friday, June 14, 2019 @ 05:06 PM gHale

Cisco cleared a vulnerability in the web-based UI (web UI) of its IOS XE Software that could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.

The vulnerability is because of insufficient CSRF protections for the web UI on an affected device.

Cisco Issues Series of Security Fixes
Cisco Fixes Critical PI, EPN Holes
Cisco Deals with Remote Attack Holes
Cisco Fixes Elastic Services Controller Hole

An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or reload an affected device.

Cisco released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This vulnerability affects Cisco devices that are running a release of IOS XE Software with the HTTP Server feature enabled. The default state of the HTTP Server feature is version dependent.

Disabling the HTTP Server feature eliminates the attack vector for this vulnerability and may be a suitable mitigation until affected devices can be upgraded.

Administrators can disable the HTTP Server feature by using the no ip http server or no ip http secure-server command in global configuration mode. If http server and http-secure server are in use, then both commands are required to disable the HTTP Server feature.

The Cisco Product Security Incident Response Team (PSIRT) is aware of the existence of exploit code that demonstrates this vulnerability on Cisco IOS XE Software. However, they said there are no indications this exploit code is publicly available.

Leave a Reply

You must be logged in to post a comment.