SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2014-7990

Cisco IOS XE 3.5E and earlier on WS-C3850, WS-C3860, and AIR-CT5760 devices does not properly parse the "request system shell" challenge response, which allows local users to obtain Linux root access by leveraging administrative privilege, aka Bug ID…

MEDIUM 6.8EPSS 0.34%

Does this matter?

Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.

Description

Cisco IOS XE 3.5E and earlier on WS-C3850, WS-C3860, and AIR-CT5760 devices does not properly parse the "request system shell" challenge response, which allows local users to obtain Linux root access by leveraging administrative privilege, aka Bug ID CSCur09815.

CVSS 2.0
6.8 MEDIUMAV:L/AC:L/Au:S/C:C/I:C/A:C
EPSS
0.34% probability · 28th percentile
CISA KEV
Not listed
Weakness
CWE-20
Affected
cisco/ios xe · cisco/air-ct5760 · cisco/ws-c3850 · cisco/ws-c3860
Source
psirt@cisco.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.