A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain ele…

Published 8 y ago 2018-03-28 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

3.2%

percentile 88%

Public exploits

none known

A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability exists because the affected software does not reset the privilege level for each web UI session. An attacker who has valid credentials for an affected device could exploit this vulnerability by remotely accessing a VTY line to the device. A successful exploit could allow the attacker to access an affected device with the privileges of the user who previously logged in to the web UI. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, if the HTTP Server feature is enabled and authentication, authorization, and accounting (AAA) authorization is not configured for EXEC sessions. The default state of the HTTP Server feature is version-dependent. This vulnerability was introduced in Cisco IOS XE Software Release 16.1.1. Cisco Bug IDs: CSCvf71769.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 23 mo ago 2024-12-02

Exploit prediction (EPSS)

3.23% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	9.0	`AV:N/AC:L/Au:S/C:C/I:C/A:C`

Affected products

n/a Cisco IOS XE Software

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls
CWE-613 DEPRECATED: Insufficient Session Expiration

Technology feeds

Cisco IOS (RSS, critical only)

References

securityfocus.com /bid/103558 · vdb-entry, x_refsource_BID, x_transferred
securitytracker.com /id/1040597 · vdb-entry, x_refsource_SECTRACK, x_transferred
tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xepriv · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-0152
NVD: CVE-2018-0152

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary