CVE-2014-7990 Privilege escalation in n/a
Local administrators can escalate privileges to Linux root on Cisco IOS XE devices due to improper parsing of challenge responses.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-7990?
CVE-2014-7990 is a medium-severity vulnerability in Cisco Ios Xe, published on 7 Nov 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cisco IOS XE 3.5E and earlier on WS-C3850, WS-C3860, and AIR-CT5760 devices does not properly parse the "request system shell" challenge response, which allows local users to obtain Linux root access by leveraging administrative privilege, aka Bug ID CSCur09815.
Weakness: CWE-20
Which versions are affected by CVE-2014-7990?
It affects 4 products.
Products include Cisco Air-Ct5760, Cisco Ios Xe, Cisco Ws-C3850, Cisco Ws-C3860.
How do I fix CVE-2014-7990?
No fix has been published for CVE-2014-7990 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-7990 being exploited?
There is no known exploitation of CVE-2014-7990 in the wild and no public exploit code.
Sources
Also known as GHSA-m25p-g3cf-hvcp.