Cisco released a security update for critical Authentication Bypass vulnerability that resides in the Cisco REST API virtual service container for Cisco IOS XE Software allows a remote attacker to bypass the authentication in managed Cisco devices.
Cisco IOS XE is an internetworking OS that mainly deployed in Cisco ARS 1000 series routers and Catalyst switches such as 3850 that operating in enterprise wired and wireless access, aggregation, core, and WAN.
An Authentication Bypass vulnerability affected the Cisco IOS XE due to an improper check performed by the area of code that manages the REST API authentication service.
Cisco REST API is an application that running in the virtual service container, a virtualized environment on a device.
An attacker could exploit the vulnerability by sending malicious HTTP requests to the targeted device. Once the target system has been successfully exploited, the attacker to obtain the token-id of an authenticated user.
If the attacker has successfully obtained the authentication token key, it allows him to bypass the device authentication and execute the system privilege via an interface of the REST API virtual service container.
The Authentication bypass vulnerability affected the following series:
According to Cisco, In order to exploit the vulnerability, the attack needs to meet with the following conditions:
In order to find whether the Cisco REST API service container is enabled, the admin can use the following command and refer the output.
router#show virtual-service detail | include Restful
Restful API Enabled, UP port: 55443
If you will not find the string Enabled, UP then your device is not affected by this vulnerability.
If the device Is using an Affected Cisco REST API Virtual Service Container Release, you can use the following privileged EXEC command.
router#show virtual-service version installed
Virtual service csr_mgmt installed version:
If you can see the combination of the virtual service name and version listed in the output, then you can conclude that your device is using a vulnerable REST API virtual service container.
“Cisco has released a fixed version of the REST API virtual service container and released a hardened Cisco IOS XE Software that prevents installation or activation of a vulnerable container on a device”
If the device was already configured with an active vulnerable container, the IOS XE Software upgrade will deactivate the container, making the device not vulnerable.
A zero-day vulnerability affecting on-premise instances of Fortra's GoAnywhere MFT-managed file transfer solution was actively…
CERT-FR, the French Computer Emergency Response Team (CERT-FR), as well as administrators and hosting providers,…
F5 reports a high-severity format string vulnerability in BIG-IP that might allow an authenticated attacker…
Cloud Computing Penetration Testing is a method of actively checking and examining the Cloud system…
Threat Intelligence Tools are more often used by security industries to test the vulnerabilities in…