Cisco Patches Critical Vulnerability that allows Remote Attacker to Conduct CSRF Attack

Cisco patches a critical vulnerability in the web-based UI (web UI) of Cisco IOS XE Software that could cause allow an unauthenticated, remote attacker to perform a CSRF attack on the vulnerable system.

The vulnerability is due to a lack of validation in the web UI, which allows an attacker to exploit this vulnerability by convincing the current user to follow the malicious link.

Successful exploitation of the vulnerability allows an attacker to perform arbitrary code execution with the privileges of the affected user.

If the affected user has administrative privileges, then the attacker could execute commands, reload the device, and alter the configuration of the vulnerable device.

The vulnerability was detected during internal security testing, and it can be tracked as CVE-2019-1904.

“Cisco Product Security Incident Response Team (PSIRT) aware of the existence of exploit code, but there are no indications at this time that this exploit code is publicly available. Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory,” reads the Cisco report.

Administrators can determine the Cisco IOS XE Software release is running on a device by using the following command.

ios-xe-device# show version

Cisco confirms there is no workaround for the issue at this time, recommended disabling HTTP Server feature to eliminate the attack vector until the affected are upgraded.

“Administrators can disable the HTTP Server feature by using the no ip http server or no ip http secure-server command in global configuration mode.”

Cisco released security updates to address this vulnerability; you can use Cisco IOS Software Checker to lookup for Cisco Security Advisories that apply to specific Cisco IOS and IOS XE Software releases.