Cisco Fixes Critical IOx Flaw Allowing Root Access to Guest OS

mood · Sep 26, 2019

Cisco Fixes Critical IOx Flaw Allowing Root Access to Guest OS
September 26, 2019
https://www.bleepingcomputer.com/ne...al-iox-flaw-allowing-root-access-to-guest-os/

Cisco has released security updates to address a critical vulnerability in the IOx application environment for Cisco IOS Software that could enable authenticated remote attackers to access the Guest Operating System (Guest OS) as the root user.

This high severity security flaw caused by an improper access control weakness is tracked as CVE-2019-12648 and it has a CVSS 3.0 base score of 9.9/10.

"The vulnerability is due to incorrect role-based access control (RBAC) evaluation when a low-privileged user requests access to a Guest OS that should be restricted to administrative accounts," says the security advisory. "An attacker could exploit this vulnerability by authenticating to the Guest OS by using the low-privileged-user credentials."
Cisco has released free security updates to address the vulnerability for all impacted devices and advises customers to contact the Cisco Technical Assistance Center (TAC) or contracted maintenance providers for further info if needed.
Click to expand...

Log in or Sign up

Cisco Fixes Critical IOx Flaw Allowing Root Access to Guest OS

mood Updates Team

Symantec Fixes Privilege Escalation Flaw in Endpoint Protection

Nautilus ATM Flaws Could Allow Hackers Access to Cash, Data

Year-Old Samba Bug Allows Access to Forbidden Root Share Paths

How MuleSoft patched a critical security flaw and avoided a disaster

Critical Flaw in Evernote Add-On Exposed Sensitive Data of Millions

Log in or Sign up

Cisco Fixes Critical IOx Flaw Allowing Root Access to Guest OS

mood Updates Team

Symantec Fixes Privilege Escalation Flaw in Endpoint Protection

Nautilus ATM Flaws Could Allow Hackers Access to Cash, Data

Year-Old Samba Bug Allows Access to Forbidden Root Share Paths

How MuleSoft patched a critical security flaw and avoided a disaster

Critical Flaw in Evernote Add-On Exposed Sensitive Data of Millions

Useful Searches