Cisco IOS XE CLI Parser Argument access control

Summaryinfo

A vulnerability was found in Cisco IOS XE. It has been declared as critical. This vulnerability affects unknown code of the component CLI Parser. Such manipulation as part of Argument leads to access control. This vulnerability is traded as CVE-2018-0184. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cisco IOS XE (Router Operating System) (version now known). Affected by this issue is some unknown processing of the component CLI Parser. The manipulation as part of a Argument leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCve74432.

The bug was discovered 03/28/2018. The weakness was shared 03/28/2018 with Cisco as cisco-sa-20180328-privesc2 as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2018-0184 since 11/27/2017. The attack needs to be approached locally. Required for exploitation is a simple authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 02/06/2021). The MITRE ATT&CK project declares the attack technique as T1068.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 316229 (Cisco IOS XE Software Privileged EXEC Mode Root Shell Access Vulnerability(cisco-sa-20180328-privesc2)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103550†). The entries VDB-115187, VDB-115186, VDB-115185 and VDB-115182 are related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion