CVE-2019-1754

Cisco IOS XE Software Privilege Escalation Vulnerability

State: Published
Severity: 8.8 High
Published: Mar 28, 2019
Updated: Nov 20, 2024
Reserved: Dec 6, 2018

Description

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker could exploit this vulnerability by submitting a malicious payload to a specific endpoint in the web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.

Scores

CVSS	Score	Vector	Source
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-20

Affected Products

Product	Versions
Cisco IOS XE SoftwareCisco	3.2.0JAAffected 16.7.1Affected 16.7.1aAffected 16.7.1bAffected 16.8.1Affected 16.8.1aAffected 16.8.1bAffected 16.8.1sAffected 16.8.1cAffected 16.8.1dAffected 16.8.2Affected 16.8.1eAffected 16.9.1bAffected 16.9.1sAffected 16.9.1cAffected 16.9.1dAffected

References

20190327 Cisco IOS XE Software Privilege Escalation Vulnerabilityvendor-advisory
107590vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.