Intrusion PreventionCisco.IOS.XE.WebUI.Command.Injection
Description
This indicates an attack attempt to exploit a Command Injection Vulnerability in Cisco Systems IOS XE.
A remote, authenticated attacker with any non-zero privilege level can exploit this vulnerability by sending a crafted request to the pingAndTrace endpoint. Successful exploitation results in the execution of arbitrary console commands in privileged exec mode.
Affected Products
Cisco Systems IOS XE 16.10.1
Cisco Systems IOS XE 16.11.1
Cisco Systems IOS XE 16.9.x, 16.8.x, and 16.7.x prior to 16.9.4
Cisco Systems IOS XE 16.x prior to 16.6.7
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-webui-cmd-injection
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
Version Updates
| Date | Version | Detail |
|---|---|---|
| 2019-11-13 | 14.723 | Default_action:pass:drop |
| 2019-10-30 | 14.714 | Sig Added |
| 2019-10-24 | 14.710 |
| ID | 48456 |
| Created | Oct 30, 2019 |
| Updated | May 02, 2022 |
| Risk |
|
| CVE ID | CVE-2019-12651 CVE-2019-12650 |
| Exploit Prediction Score | 87.56% |
| Default Action | drop |
| Active | |
| Affected OS | Other |
| Affected App | Cisco |