If the device is running Cisco IOS XE Software, the system banner displays Cisco IOS Software, Cisco IOS XE Software, or similar text.

To determine which Cisco IOS XE Software release is running on a device, administrators can log in to the device, use the show version command in the CLI, and then refer to the system banner that appears. Ip http secure-server Determining the Cisco IOS XE Software Release The following example shows the output of the show running-config | include http (secure|server) command for a router that has the HTTP Server feature enabled: Router# show running-config | include http (secure|server) If either command is present and configured, the HTTP Server feature is enabled for the device. To determine whether the HTTP Server feature is enabled for a device, administrators can log in to the device and use the show running-config | include http (secure|server) command in the CLI to check for the presence of the ip http server command or the ip http secure-server command in the global configuration. This vulnerability affects Cisco devices that are running an affected release of Cisco IOS XE Software with the web server feature enabled.įor information about which Cisco IOS XE Software releases are vulnerable, see the Fixed Software section of this advisory. For a complete list of the advisories and links to them, see Cisco Event Response: March 2019 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. This advisory is part of the March 27, 2019, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 17 Cisco Security Advisories that describe 19 vulnerabilities.

This advisory is available at the following link: There are no workarounds that address this vulnerability. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.Ĭisco has released software updates that address this vulnerability. An attacker could exploit this vulnerability by submitting a malicious payload to the affected device's web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent (WSMA) functions. A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI.

Pes 2019 ios