What is CVE-2001-0537?

CVE-2001-0537 is a vulnerability in Cisco iOS, classified under Improper Authentication. Published 2001-07-21.

Is CVE-2001-0537 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Cisco iOS

CVE-2001-0537

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.

Vulnerability class: Broken Authentication

Published 2001-07-21 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.684 (99.3th percentile), scored 2026-10-17.

High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.684 · newest: 0.684 · change: 0.000

Affected products

Cisco iOS — versions 11.3, 12.0(14)w5(20), 12.0xb

Weakness classification (CWE)

CWE-287 — Improper Authentication

Public proof-of-concept exploits

References

www.cert.org/advisories/CA-2001-14.html (US Government Resource, Exploit, Patch, Third Party Advisory, third-party-advisory)
www.securityfocus.com/archive/1/4.3.2.7.2.20010629095801.0c3e6a70@brussels.cisc… (mailing-list)
www.cisco.com/warp/public/707/IOS-httplevel-pub.html (Exploit, vendor-advisory, Patch, Vendor Advisory)
www.securityfocus.com/archive/1/20010703011650.60515.qmail@web14910.mail.yahoo… (mailing-list)
www.securityfocus.com/archive/1/1601227034.20010702112207@olympos.org (mailing-list)
www.osvdb.org/578 (vdb-entry)
www.securityfocus.com/archive/1/Pine.LNX.3.96.1010702134611.22995B-100000@Lib-V… (mailing-list)
www.ciac.org/ciac/bulletins/l-106.shtml (government-resource, third-party-advisory)
www.securityfocus.com/bid/2936 (Exploit, Patch, vdb-entry, Vendor Advisory)
exchange.xforce.ibmcloud.com/vulnerabilities/6749 (vdb-entry)

Frequently asked questions

What is CVE-2001-0537?: CVE-2001-0537 is a vulnerability in Cisco iOS, classified under Improper Authentication. Published 2001-07-21.
Is CVE-2001-0537 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.