Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Cisco IOS XE lets remote user run any command

CVE-2019-1755 · published 7 years ago
Summary

The Web Services Management Agent in Cisco IOS XE can be tricked by a logged‑in attacker into running any command on the device. This occurs because the software does not properly clean the data it receives from web requests. To protect yourself, install Cisco’s update that fixes the problem, limit who can log in to the management interface, and use strong authentication.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco ios_xe 3.2.0ja
3.6.10e
16.1.1
16.1.2
16.1.3
16.2.1
16.2.2
16.3.1
16.3.1a
16.3.2
16.3.3
16.3.4
26 more version ranges
cpe:2.3:o:cisco:ios_xe:3.2.0ja:*:*:*:*:*:*:*
Original advisory text
A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege le...
A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker could exploit this vulnerability by submitting crafted HTTP requests to the targeted application. A successful exploit could allow the attacker to execute arbitrary commands on the affected device.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.2 High
Exploitation
3% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published28 Mar 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-1755 · NVD
Track software like this
Free during beta