CVE-2019-12648

A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests access to a Guest OS that should be restricted to administrative accounts. An attacker could exploit this vulnerability by authenticating to the Guest OS by using the low-privileged-user credentials. An exploit could allow the attacker to gain unauthorized access to the Guest OS as a root user.

CVSS v3 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cisco:ios:15.7\(3\)m3:*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:807_industrial_integrated_services_routers:-:::::::*
	cpe:2.3:h:cisco:809_industrial_integrated_services_routers:-:::::::*
	cpe:2.3:h:cisco:829_industrial_integrated_services_routers:-:::::::*
	cpe:2.3:h:cisco:cgr_1120:-:::::::*
	cpe:2.3:h:cisco:cgr1240:-:::::::*

History

No history.

Information

Published : 2019-09-25 20:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-12648

Mitre link : CVE-2019-12648

CVE.ORG link : CVE-2019-12648

JSON object : View

Products Affected

cisco

807_industrial_integrated_services_routers
ios
829_industrial_integrated_services_routers
cgr1240
809_industrial_integrated_services_routers
cgr_1120

CWE

CWE-863

Incorrect Authorization

CWE-284

Improper Access Control

{"id": "CVE-2019-12648", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-09-25T20:15:10.477", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests access to a Guest OS that should be restricted to administrative accounts. An attacker could exploit this vulnerability by authenticating to the Guest OS by using the low-privileged-user credentials. An exploit could allow the attacker to gain unauthorized access to the Guest OS as a root user."}, {"lang": "es", "value": "Una vulnerabilidad en el entorno de la aplicaci\u00f3n IOx para Software Cisco IOS, podr\u00eda permitir a un atacante remoto autenticado conseguir acceso no autorizado al Sistema Operativo Invitado (SO Invitado) que es ejecutado en un dispositivo afectado. La vulnerabilidad es debido a una evaluaci\u00f3n incorrecta del control de acceso basado en roles (RBAC) cuando un usuario poco privilegiado solicita acceso a un SO Invitado que debe ser restringida a cuentas administrativas. Un atacante podr\u00eda explotar esta vulnerabilidad mediante la autenticaci\u00f3n en el Sistema Operativo Invitado mediante el empleo de las credenciales de un usuario poco privilegiado. Una explotaci\u00f3n podr\u00eda permitir al atacante conseguir acceso no autorizado al sistema operativo invitado como un usuario root."}], "lastModified": "2019-10-09T23:45:57.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios:15.7\\(3\\)m3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64404B00-4956-47B8-ACDB-88E365E97212"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:807_industrial_integrated_services_routers:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3C197660-0D0F-4D80-8EF5-9A60E679BD24"}, {"criteria": "cpe:2.3:h:cisco:809_industrial_integrated_services_routers:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3C996F3B-0333-4B9A-B3E7-F50E64B0AAB3"}, {"criteria": "cpe:2.3:h:cisco:829_industrial_integrated_services_routers:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F0D05CC9-8D04-4DE0-A854-375192B4D46C"}, {"criteria": "cpe:2.3:h:cisco:cgr_1120:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1119E8B9-53A3-4724-9EEB-F4A35F9F59E1"}, {"criteria": "cpe:2.3:h:cisco:cgr1240:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D1FE609C-8021-48C8-AF15-F176D82A9B23"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}