CVE-2019-12648 Cisco IOx for IOS Software Guest Operating System Unauthorized Access Vulnerability

Critical 9.9 Published 25 Sep 2019 Updated 20 Nov 2024

Authenticated low-privileged users can bypass RBAC to gain root access to the Guest OS in Cisco IOx environments.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-12648?

CVE-2019-12648 is a critical authentication bypass vulnerability in Cisco Ios, published on 25 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the IOx application environment for Cisco IOS Software could allow an authenticated, remote attacker to gain unauthorized access to the Guest Operating System (Guest OS) running on an affected device. The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests access to a Guest OS that should be restricted to administrative accounts. An attacker could exploit this vulnerability by authenticating to the Guest OS by using the low-privileged-user credentials. An exploit could allow the attacker to gain unauthorized access to the Guest OS as a root user.

Weakness: CWE-863, CWE-284

Which versions are affected by CVE-2019-12648?

It affects 1 product.

Products include Cisco Ios.

How do I fix CVE-2019-12648?

No fix has been published for CVE-2019-12648 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2019-12648 being exploited?

There is no known exploitation of CVE-2019-12648 in the wild and no public exploit code.

All Cisco Ios vulnerabilities

Sources

Also known as GHSA-hfqm-f33h-w94m.