Cisco IOx for IOS Software Guest Operating System Unauthorized Access Vulnerability
A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests access to a Guest OS that should be restricted to administrative accounts. An attacker could exploit this vulnerability by authenticating to the Guest OS by using the low-privileged-user credentials. An exploit could allow the attacker to gain unauthorized access to the Guest OS as a root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth"] This advisory is part of the September 25, 2019, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2019 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-72547"].
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-12648US | high8.8OT elevated | — | ||
A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (G… | ||||
references
External citations — patches, advisories, analysis.
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-authexternal
- Security Vulnerability Policyexternal
- considering software upgradesexternal
- Cisco IOS Software Checkerexternal
- Cisco Event Response: September 2019 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publicationexternal
- https://www.cisco.com/c/en/us/products/end-user-license-agreement.htmlexternal
- https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.htmlexternal
- Cisco Security Advisories and Alerts pageexternal
remediations (34)
- Fixed15.1(3)SVR1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVR10
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVR2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVR3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVS
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVS1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVT1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVT2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVT3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVT4
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVU1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVU10
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVU11
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVU2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVU20
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVU21
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVV1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVV2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVV3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVV4
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVW
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVW1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVX
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.1(3)SVX1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.7(3)M
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.7(3)M1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.7(3)M2
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.7(3)M3
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.7(3)M4
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.7(3)M4a
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.7(3)M4b
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.8(3)M
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.8(3)M0a
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed15.8(3)M1
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan