Detections
Analytics
Cisco IOS XE Software Diagnostic Shell Path Traversal Vulnerability (cisco-sa-20180207-ios)
medium Nessus Plugin ID 107091
Language:
Synopsis
The remote device is missing a vendor-supplied security patch.Description
According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a path traversal vulnerability. A flaw exists with the diagnostic shell due to improper validation of diagnostic shell commands. An authenticated attacker, with a specially craft command, could potentially overwrite restricted system files.Solution
Upgrade to the relevant fixed version referenced in Cisco Security Advisory cisco-sa-20180207-ios.See Also
Plugin Details
Severity: Medium
ID: 107091
File Name: cisco-sa-20180207-iosxe.nasl
Version: 1.9
Type: combined
Family: CISCO
Published: 3/1/2018
Updated: 5/3/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4.9
Temporal Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:N
CVSS Score Source: CVE-2018-0123
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:cisco:ios_xe
Required KB Items: Host/Cisco/IOS-XE/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 2/7/2018
Vulnerability Publication Date: 2/7/2018
Reference Information
CVE: CVE-2018-0123
BID: 102967