CVE-2019-1753

Cisco IOS XE Software Privilege Escalation Vulnerability

State: Published
Severity: 8.8 High
Published: Mar 28, 2019
Updated: Nov 20, 2024
Reserved: Dec 6, 2018

Description

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent (WSMA) functions. An attacker could exploit this vulnerability by submitting a malicious payload to the affected device's web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.

Scores

CVSS	Score	Vector	Source
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-20

Affected Products

Product	Versions
Cisco IOS XE SoftwareCisco	3.6.10EAffected 16.1.1Affected 16.1.2Affected 16.1.3Affected 3.2.0JAAffected 16.2.1Affected 16.2.2Affected 16.3.1Affected 16.3.2Affected 16.3.3Affected 16.3.1aAffected 16.3.4Affected 16.3.5Affected 16.3.5bAffected 16.3.6Affected 16.3.7Affected 16.3.8Affected 16.4.1Affected 16.4.2Affected 16.4.3Affected 16.5.1Affected 16.5.1aAffected 16.5.1bAffected 16.5.2Affected 16.5.3Affected and 13 more versions

Product

Versions

Cisco IOS XE SoftwareCisco

3.6.10EAffected
16.1.1Affected
16.1.2Affected
16.1.3Affected
3.2.0JAAffected
16.2.1Affected
16.2.2Affected
16.3.1Affected
16.3.2Affected
16.3.3Affected
16.3.1aAffected
16.3.4Affected
16.3.5Affected
16.3.5bAffected
16.3.6Affected
16.3.7Affected
16.3.8Affected
16.4.1Affected
16.4.2Affected
16.4.3Affected
16.5.1Affected
16.5.1aAffected
16.5.1bAffected
16.5.2Affected
16.5.3Affected
and 13 more versions

References

20190327 Cisco IOS XE Software Privilege Escalation Vulnerabilityvendor-advisory
107602vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.