A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to con
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration changes through the HTTP GET method. An attacker could exploit this vulnerability by persuading a currently authenticated administrator to follow a crafted link. A successful exploit could allow the attacker to change the configuration of the affected device.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Cisco IOS
15.2(6)E2, 15.2(7)E, 15.2(6)E2a, 15.2(6)E2b, 15.2(7)E1, 15.2(7)E0a, 15.2(7)E0b, 15.2(7)E0s, 15.2(6)E3, 15.2(7)E2, 15.2(7a)E0b, 15.2(7)E3, 15.2(7)E1a, 15.2(7b)E0b, 15.2(7)E2a, 15.2(7)E4, 15.2(7)E3k, 15.2(8)E, 15.2(8)E1, 15.2(7)E5, 15.2(7)E6, 15.2(8)E2, 15.2(7)E7, 15.2(8)E3, 15.2(7)E8, 15.2(8)E4, 15.2(7)E9, 15.2(8)E5, 15.2(7)E10, 15.2(6)EB
- Cisco Cisco IOS XE Software
3.2.0SG, 3.2.1SG, 3.2.2SG, 3.2.3SG, 3.2.4SG, 3.2.5SG, 3.2.6SG, 3.2.7SG, 3.2.8SG, 3.2.9SG, 3.2.10SG, 3.2.11SG, 3.7.0S, 3.7.1S, 3.7.2S, 3.7.3S, 3.7.4S, 3.7.5S, 3.7.6S, 3.7.7S, 3.7.4aS, 3.7.2tS, 3.7.0bS, 3.7.1aS, 3.3.0SG, 3.3.2SG, 3.3.1SG, 3.8.0S, 3.8.1S, 3.8.2S, and 401 more