Cisco IOS on Cisco 800 Embedded Test Subsystem write-what-where condition

Summaryinfo

A vulnerability was found in Cisco IOS on Cisco 800. It has been rated as critical. This issue affects some unknown processing of the component Embedded Test Subsystem. Performing a manipulation results in write-what-where condition. This vulnerability is reported as CVE-2018-15375. The attack requires a local approach. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco IOS on Cisco 800 (Router Operating System) (version unknown). This affects an unknown function of the component Embedded Test Subsystem. The manipulation with an unknown input leads to a write-what-where condition vulnerability. CWE is classifying the issue as CWE-123. Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to be available only in internal development builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affected device. A successful exploit could allow the attacker to write arbitrary values to arbitrary locations in the memory space of the affected device.

The bug was discovered 09/26/2018. The weakness was disclosed 10/05/2018 as cisco-sa-20180926-ir800-memwri as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is uniquely identified as CVE-2018-15375 since 08/17/2018. Attacking locally is a requirement. The successful exploitation requires a authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316336 (Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities(cisco-sa-20180926-ir800-memwrite)).

Upgrading eliminates this vulnerability.

The entry VDB-124888 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion