RCE in Cisco iOS Xe Software
CVE-2018-0481
A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exist because the affected software improperly sanitizes command arguments, failing to prevent access to certain internal data structures on an affected device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit these vulnerabilities on the device by executing CLI commands that contain custom arguments. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the affected device.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.005 (39.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cisco Ios Xe Software — versions n/a
- Cisco Ios_xe — versions 15.3\(3\)s3.16, 16.7\(1\), 16.7.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2018-0481?
- CVE-2018-0481 is a medium-severity vulnerability in Cisco iOS Xe Software, classified under Command Injection. CVSS score: 6.7/10. Published 2018-10-05.
- How severe is CVE-2018-0481?
- Medium severity. CVSS v3 base score is 6.7 out of 10.
- Is CVE-2018-0481 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.