CVE-2019-12648 : A vulnerability in the IOx application environment for Cisco IOS Software could

A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests access to a Guest OS that should be restricted to administrative accounts. An attacker could exploit this vulnerability by authenticating to the Guest OS by using the low-privileged-user credentials. An exploit could allow the attacker to gain unauthorized access to the Guest OS as a root user.

Published 2019-09-25 20:15:10

Updated 2019-10-09 23:45:57

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2019-12648

Cisco » IOS » Version: 15.7(3)m3
cpe:2.3:o:cisco:ios:15.7\(3\)m3:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » 807 Industrial Integrated Services Routers » Version: N/A
When used together with: Cisco » 809 Industrial Integrated Services Routers » Version: N/A
When used together with: Cisco » 829 Industrial Integrated Services Routers » Version: N/A
When used together with: Cisco » Cgr 1120 » Version: N/A
When used together with: Cisco » Cgr1240 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-12648

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-12648

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C	8.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.9	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	3.1	6.0	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-12648

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: ykramarz@cisco.com (Secondary)
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-12648

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth

Cisco IOx for IOS Software Guest Operating System Unauthorized Access Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2019-12648

Products affected by CVE-2019-12648

Exploit prediction scoring system (EPSS) score for CVE-2019-12648

CVSS scores for CVE-2019-12648

CWE ids for CVE-2019-12648

References for CVE-2019-12648