CVE-2019-12648 | A vulnerability in the IOx application environment for Cisco… | CVSS 9.9 CRITICAL

Description

A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests access to a Guest OS that should be restricted to administrative accounts. An attacker could exploit this vulnerability by authenticating to the Guest OS by using the low-privileged-user credentials. An exploit could allow the attacker to gain unauthorized access to the Guest OS as a root user.

Metadata

CVE ID: CVE-2019-12648
State: PUBLISHED
Assigner: cisco
Reserved: 2019-06-04 00:00 UTC
Published: 2019-09-25 20:05 UTC
Last updated: 2024-11-20 17:10 UTC
Primary CWE: CWE-284
CWE-284
Vendor / Product: Cisco / Cisco IOS 15.7(3)M
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Cisco	Cisco IOS 15.7(3)M	—	unspecified < n/a

Weakness (CWE)

CWE	Source	Description
CWE-284	cna	CWE-284

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (1)

20190925 Cisco IOx for IOS Software Guest Operating System Unauthorized Access Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth