CVE-2019-1745
HIGHCisco IOS XE - Authenticated OS Command Injection via Affected Commands
Title source: llmDescription
A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected commands. An exploit could allow the attacker to gain root privileges on the affected device.
References (2)
Core 2
Core References
Patch, Vendor Advisory vendor-advisory
x_refsource_cisco
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-xecmd
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/107588
Scores
CVSS v3
7.8
EPSS
0.0045
EPSS Percentile
35.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (50)
cisco/ios_xe
3.6.10e
cisco/ios_xe
3.10.0s
cisco/ios_xe
3.10.1s
cisco/ios_xe
3.10.2as
cisco/ios_xe
3.10.2s
cisco/ios_xe
3.10.2ts
cisco/ios_xe
3.10.3s
cisco/ios_xe
3.10.4s
cisco/ios_xe
3.10.5s
cisco/ios_xe
3.10.6s
... and 40 more
Published
Mar 28, 2019
Tracked Since
Feb 18, 2026