Cisco IOS XE CLI Parser Argument access control

Summaryinfo

A vulnerability was found in Cisco IOS XE. It has been classified as critical. This affects an unknown part of the component CLI Parser. This manipulation as part of Argument causes access control. This vulnerability appears as CVE-2018-0183. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in Cisco IOS XE (Router Operating System) (unknown version). Affected by this vulnerability is an unknown code block of the component CLI Parser. The manipulation as part of a Argument leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuv91356.

The bug was discovered 03/28/2018. The weakness was presented 03/28/2018 with Cisco as cisco-sa-20180328-privesc3 as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is known as CVE-2018-0183 since 11/27/2017. Attacking locally is a requirement. The requirement for exploitation is a single authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/17/2020). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 316228 (Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers Privileged EXEC Mode Root Shell Access Vulnerability(cisco-sa-20180328-privesc3)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103555†). See VDB-115187, VDB-115186, VDB-115184 and VDB-115185 for similar entries. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion