Vulnerability Description
Cisco IOS XE 3.5E and earlier on WS-C3850, WS-C3860, and AIR-CT5760 devices does not properly parse the "request system shell" challenge response, which allows local users to obtain Linux root access by leveraging administrative privilege, aka Bug ID CSCur09815.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios Xe | <= 3.5e |
| Cisco | Air-Ct5760 | All versions |
| Cisco | Ws-C3850 | All versions |
| Cisco | Ws-C3860 | All versions |
Related Weaknesses (CWE)
References
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7990Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=36351Vendor Advisory
- http://www.securityfocus.com/bid/70968
- http://www.securitytracker.com/id/1031179
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98529
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7990Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=36351Vendor Advisory
- http://www.securityfocus.com/bid/70968
- http://www.securitytracker.com/id/1031179
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98529
FAQ
What is CVE-2014-7990?
CVE-2014-7990 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Cisco IOS XE 3.5E and earlier on WS-C3850, WS-C3860, and AIR-CT5760 devices does not properly parse the "request system shell" challenge response, which allows local users to obtain Linux root access ...
How severe is CVE-2014-7990?
CVE-2014-7990 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-7990?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios Xe, Cisco Air-Ct5760, Cisco Ws-C3850, Cisco Ws-C3860.