Cisco IOS and IOS XE Software CLI Denial of Service Vulnerability

TL;DR 📌

A medium-severity vulnerability has been identified in the CLI of Cisco IOS and IOS XE Software, allowing an authenticated local attacker to cause a denial of service (DoS) by exploiting a buffer overflow. No workarounds are available, and Cisco recommends upgrading to fixed software releases.

What happened 🕵️‍♂️

A vulnerability in the CLI of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. This issue arises from a buffer overflow that can be exploited using crafted commands at the CLI prompt. While proof-of-concept exploit code is available, there have been no reports of malicious exploitation.

Affected products 🖥️

This vulnerability affects Cisco IOS and IOS XE Software if the shell processing full command is configured. This command is disabled by default. To check if your device is affected, log in and run the command: show run | include shell. If there is no output, your device is not affected.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no official workarounds that address this vulnerability. However, removing the shell processing full command can eliminate the attack vector. This can be done by entering no shell processing full in global configuration mode. Customers should evaluate the impact of this mitigation in their own environments before implementation.

Risk in context 🎯

The highest CVSS score for this vulnerability is 6.5, categorizing it as Medium severity. The risk is primarily driven by the requirement for local authentication, which limits exposure. However, the potential for denial of service could impact availability, making it essential for affected organizations to prioritize remediation.

Fast facts ⚡

• Vulnerability: CLI Denial of Service
• CVSS Score: 6.5 (Medium)
• Attack Vector: Local (authenticated)
• Impact: Device reload causing DoS
• Workarounds: None officially; removal of shell processing full command is a temporary mitigation.

For leadership 🧭

This vulnerability presents a Medium risk to our network infrastructure. It requires local authentication for exploitation, which limits exposure, but successful attacks can lead to device unavailability. Immediate action is recommended to patch affected devices within 7 days of the fixed software release.

Operational impact is expected to be minimal, with a brief maintenance window required for upgrades and no expected configuration drift.

Now: Identify affected devices and prioritize patching.
Next: Implement the fixed software as soon as possible.
Later: Monitor for any signs of exploitation and review security policies to mitigate future vulnerabilities.

Please note that while proof-of-concept exploits exist, there have been no reports of active exploitation.