RCE in Cisco iOS Xe Software
CVE-2018-0477
A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exist because the affected software improperly sanitizes command arguments, failing to prevent access to certain internal data structures on an affected device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit these vulnerabilities on the device by executing CLI commands that contain custom arguments. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the affected device.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (40.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 40.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Cisco iOS Xe Software
- Cisco iOS Xe — versions 15.3\(3\)s3.16, 16.7\(1\), 15.3(3)s3.16
Weakness classification (CWE)
Public proof-of-concept exploits
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926… (vendor-advisory, Vendor Advisory)
- www.securitytracker.com/id/1041737 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-0477?
- CVE-2018-0477 is a medium-severity vulnerability in Cisco iOS Xe Software, classified under Command Injection. CVSS score: 6.7/10. Published 2018-10-05.
- How severe is CVE-2018-0477?
- Medium severity. CVSS v3 base score is 6.7 out of 10.
- Is CVE-2018-0477 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.