CVE-2018-15374 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

Medium 6.7 Published 5 Oct 2018 Updated 26 Nov 2024

An authenticated local attacker can bypass digital signature verification to install malicious software images on Cisco IOS XE devices.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-15374?

CVE-2018-15374 is a medium-severity vulnerability in Cisco Ios Xe, published on 5 Oct 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install a malicious software image or file on an affected device. The vulnerability is due to the affected software improperly verifying digital signatures for software images and files that are uploaded to a device. An attacker could exploit this vulnerability by uploading a malicious software image or file to an affected device. A successful exploit could allow the attacker to bypass digital signature verification checks for software images and files and install a malicious software image or file on the affected device.

Weakness: CWE-347

Which versions are affected by CVE-2018-15374?

It affects 1 product.

Products include Cisco Ios Xe.

How do I fix CVE-2018-15374?

No fix has been published for CVE-2018-15374 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-15374 being exploited?

There is no known exploitation of CVE-2018-15374 in the wild and no public exploit code.

All Cisco Ios Xe vulnerabilities

Sources

Also known as GHSA-hmgr-779r-qfww.