CVE-2019-16009CWE-352

Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability

High · published September 23, 2020

CVSS v3.0
8.8
EPSS
1%
Percentile
61.7
In the wild
Unconfirmed
What it is

A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or reload an affected device.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00975 · 61.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2020-09-23T00:26Z
EPSS history
Timeline
  • 23 SEP 00:26Z
    Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability
    cvelistv5