CVE-2021-1435
published 2021-03-24CVE-2021-1435: A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the…
PriorityP355high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
ITW
Exploited in the wild
EPSS
7.94%
94.1th percentile
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web UI of an affected device with arbitrary commands injected into a portion of the request. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios_xe_software | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv3.06.6MEDIUMCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vulncheck7.2HIGH
cisa7.2HIGH
vendor_cisco6.6MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Cisco IOS XE Web UI Command Injection Vulnerability
cisa·2023-10-23·CVSS 7.2
CVE-2023-20273 [HIGH] CWE-78 Cisco IOS XE Web UI Command Injection Vulnerability
Vulnerability: Cisco IOS XE Web UI Command Injection Vulnerability
Affected: Cisco Cisco IOS XE Web UI
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.
Required Action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instr
Cisco
Cisco IOS XE Software Web UI Command Injection Vulnerability
vendor_cisco·2021-03-24·CVSS 6.6
CVE-2021-1435 [MEDIUM] CWE-22 Cisco IOS XE Software Web UI Command Injection Vulnerability
Cisco IOS XE Software Web UI Command Injection Vulnerability
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user.
This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web UI of an affected device with arbitrary commands injected into a portion of the request. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSec
Cisco
Cisco IOS XE Software Web UI Command Injection Vulnerability
vendor_cisco·CVSS 3.0
CVE-2021-1435 Cisco IOS XE Software Web UI Command Injection Vulnerability
CVE-2021-1435: Cisco IOS XE Software Web UI Command Injection Vulnerability
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web UI of an affected device with arbitrary commands injected into a portion of the request. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-22, CWE-22
Bug IDs: CSCvq32553
VulnCheck
Cisco IOS XE Web UI Command Injection Vulnerability
vulncheck·2023·CVSS 7.2
CVE-2023-20273 [HIGH] CWE-78 Cisco IOS XE Web UI Command Injection Vulnerability
Cisco IOS XE Web UI Command Injection Vulnerability
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.
Affected: Cisco IOS XE Web UI
Required Action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine
GHSA
GHSA-5rv2-fphg-fgcg: A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed
ghsa_unreviewed·2022-05-24
CVE-2021-1435 [HIGH] CWE-22 GHSA-5rv2-fphg-fgcg: A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web UI of an affected device with arbitrary commands injected into a portion of the request. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Cisco discloses new IOS XE zero-day exploited to deploy malware implant
blogs_bleepingcomputer·2023-10-20·CVSS 7.2
CVE-2023-20273 [HIGH] Cisco discloses new IOS XE zero-day exploited to deploy malware implant
## Cisco discloses new IOS XE zero-day exploited to deploy malware implant
## Sergiu Gatlan
Cisco disclosed a new high-severity zero-day (CVE-2023-20273) today, actively exploited to deploy malicious implants on IOS XE devices compromised using the CVE-2023-20198 zero-day unveiled earlier this week.
The company said it found a fix for both vulnerabilities and estimates it will be released to customers via the Cisco Software Download Center over the weekend, starting October 22.
"Fixes for both CVE-2023-20198 and CVE-2023-20273 are estimated to be available on October 22. The CVE-2021-1435 that had previously been mentioned is no longer assessed to be associated with this activity," Cisco said today.
On Monday, Cisco disclosed that unauthenticated attackers have been exploiting the CVE
Bleepingcomputer
Over 10,000 Cisco devices hacked in IOS XE zero-day attacks
blogs_bleepingcomputer·2023-10-17·CVSS 10.0
CVE-2023-20198 [CRITICAL] Over 10,000 Cisco devices hacked in IOS XE zero-day attacks
## Over 10,000 Cisco devices hacked in IOS XE zero-day attacks
## Sergiu Gatlan
Update October 17, 16:40 EDT: Added new information on breached Cisco IOS XE devices.
Update October 18, 05:06 EDT: Orange Cyberdefense CERT discovered over 34.5K Cisco IOS XE devices compromised in CVE-2023-20198 attacks.
Attackers have exploited a recently disclosed critical zero-day bug to compromise and infect over 10,000 Cisco IOS XE devices with malicious implants.
The list of products running Cisco IOS XE software includes enterprise switches, aggregation and industrial routers, access points, wireless controllers, and more.
According to threat intelligence company VulnCheck, the maximum severity vulnerability (CVE-2023-20198) has been extensively exploited in attacks targeting Cisco IOS XE systems
Talos
Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities
blogs_talos·2023-10-16·CVSS 7.2
[HIGH] Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities
## Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities
Updates
Nov. 02 : Identified a third version of the BadCandy implant. Added expected response from the new version of the implant against one of the HTTP requests used to check for infected device.
Nov. 1: Observed increase in exploitation attempts since the publication of the proofs-of-concept (POCs) of the exploits involved. Named the Lua-based web shell “BadCandy.”
Oct. 23: Identified an updated version of the implant. Provided new curl command to check for infected devices. Fixes for CVE-2023-20198 and CVE-2023-20273 started to roll out on Oct. 22.
Oct. 20: Identified an additional vulnerability (CVE-2023-20273) that is exploited to deploy the implant. Fixes for both CVE-2023-20198 and CV
Tenable
CVE-2023-20198: Zero-Day Vulnerability in Cisco IOS XE Exploited in the Wild
blogs_tenable·2023-10-16·CVSS 10.0
[CRITICAL] CVE-2023-20198: Zero-Day Vulnerability in Cisco IOS XE Exploited in the Wild
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities
blogs_talos·2023-10-16·CVSS 7.2
[HIGH] Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerabilities
Updates
Nov. 02: Identified a third version of the BadCandy implant. Added expected response from the new version of the implant against one of the HTTP requests used to check for infected device.
Nov. 1: Observed increase in exploitation attempts since the publication of the proofs-of-concept (POCs) of the exploits involved. Named the Lua-based web shell “BadCandy.”
Oct. 23: Identified an updated version of the implant. Provided new curl command to check for infected devices. Fixes for CVE-2023-20198 and CVE-2023-20273 started to roll out on Oct. 22.
Oct. 20: Identified an additional vulnerability (CVE-2023-20273) that is exploited to deploy the implant. Fixes for both CVE-2023-20198 and CVE-2023-20273 are estimated to be available on Oct. 22. The CVE-2021-1435 that had previously bee
Bleepingcomputer
Cisco warns of new IOS XE zero-day actively exploited in attacks
blogs_bleepingcomputer·2023-10-16·CVSS 7.2
CVE-2023-20198 [HIGH] Cisco warns of new IOS XE zero-day actively exploited in attacks
## Cisco warns of new IOS XE zero-day actively exploited in attacks
## Sergiu Gatlan
Cisco warned admins today of a new maximum severity authentication bypass zero-day in its IOS XE software that lets unauthenticated attackers gain full administrator privileges and take complete control of affected routers and switches remotely.
The company says the critical vulnerability (tracked as CVE-2023-20198 and still waiting for a patch) only affects devices with the Web User Interface (Web UI) feature enabled, which also have the HTTP or HTTPS Server feature toggled on.
"Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks," the compa
Greynoiseio
Unpacking CVE-2023-20198: A Critical Weakness In Cisco IOS XE:
blogs_greynoiseio·CVSS 10.0
[CRITICAL] Unpacking CVE-2023-20198: A Critical Weakness In Cisco IOS XE:
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
Case Study: Detecting Cisco IOS XE Emerging Exploitation
blogs_greynoiseio
Case Study: Detecting Cisco IOS XE Emerging Exploitation
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
2021-03-24
Published
Exploited in the wild