// For flags

CVE-2019-16009

Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or reload an affected device.

Una vulnerabilidad en la Interfaz de Usuario web de Cisco IOS y Cisco IOS XE Software, podría permitir a un atacante remoto no autenticado conducir un ataque de tipo cross-site request forgery (CSRF) en un sistema afectado. La vulnerabilidad es debido a protecciones CSRF insuficientes para la Interfaz de Usuario web en un dispositivo afectado. Un atacante podría explotar esta vulnerabilidad al persuadir a un usuario de la interfaz para seguir un enlace malicioso. Una explotación con éxito podría permitir al atacante llevar a cabo acciones arbitrarias con el nivel de privilegio del usuario apuntado. Si el usuario presenta privilegios administrativos, el atacante podría alterar la configuración, ejecutar comandos o recargar un dispositivo afectado

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2019-09-06 CVE Reserved
  • 2020-09-23 CVE Published
  • 2024-11-02 EPSS Updated
  • 2024-11-13 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Ios
Search vendor "Cisco" for product "Ios"
 < 16.1.1
Search vendor "Cisco" for product "Ios" and version " < 16.1.1"
-
Affected
Cisco
Search vendor "Cisco"
 Ios Xe
Search vendor "Cisco" for product "Ios Xe"
 < 16.1.1
Search vendor "Cisco" for product "Ios Xe" and version " < 16.1.1"
-
Affected