Cisco IOS XE Software Arbitrary File Upload Vulnerability
Published Mar 27, 2019
8.8
HIGHCVSS 3.1
EPSS 2.17%
Description
A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the device. An exploit could allow the attacker to gain elevated privileges on the affected device.
Affected products
-
Affected
- 16.2.1
- 16.2.2
- 16.3.1
- 16.3.1a
- 16.3.2
- 16.3.3
- 16.3.4
- 16.3.5
- 16.3.5b
- 16.3.6
- 16.4.1
- 16.4.2
- 16.4.3
- 16.5.1
- 16.5.1a
- 16.5.1b
- 16.5.2
- 16.5.3
- 16.6.1
- 16.6.2
- 16.6.3
- 16.7.1
- 16.7.1a
- 16.7.1b
- 16.8.1
- 16.8.1a
- 16.8.1b
- 16.8.1c
- 16.8.1d
- 16.8.1e
- 16.8.1s
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Cisco | Cisco IOS XE Software | unknown | Affected
|
- 16.2.1
- 16.2.2
- 16.3.1
- 16.3.1a
- 16.3.2
- 16.3.3
- 16.3.4
- 16.3.5
- 16.3.5b
- 16.3.6
- 16.4.1
- 16.4.2
- 16.4.3
- 16.5.1
- 16.5.1a
- 16.5.1b
- 16.5.2
- 16.5.3
- 16.6.1
- 16.6.2
- 16.6.3
- 16.7.1
- 16.7.1a
- 16.7.1b
- 16.8.1
- 16.8.1a
- 16.8.1b
- 16.8.1c
- 16.8.1d
- 16.8.1e
- 16.8.1s
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (3)
- http://www.securityfocus.com/bid/107591 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10300 Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-afu vendor-advisoryx_refsource_CISCOPatchVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/107591 | vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-10300 | Advisory | |
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-afu | vendor-advisoryx_refsource_CISCOPatchVendor Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data