CVE-2001-0537 HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.
HighCVSS 9.3
EPSS 68.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco ios | = 11.3 | No fix listed |
| cisco ios | = 11.3aa | No fix listed |
| cisco ios | = 11.3da | No fix listed |
| cisco ios | = 11.3db | No fix listed |
| cisco ios | = 11.3ha | No fix listed |
| cisco ios | = 11.3ma | No fix listed |
| cisco ios | = 11.3na | No fix listed |
| cisco ios | = 11.3t | No fix listed |
| cisco ios | = 11.3xa | No fix listed |
| cisco ios | = 12.0 | No fix listed |
| cisco ios | = 12.0(5)xk | No fix listed |
| cisco ios | = 12.0(7)xk | No fix listed |
| cisco ios | = 12.0(10)w5(18g) | No fix listed |
| cisco ios | = 12.0(14)w5(20) | No fix listed |
| cisco ios | = 12.0da | No fix listed |
| cisco ios | = 12.0db | No fix listed |
| cisco ios | = 12.0dc | No fix listed |
| cisco ios | = 12.0s | No fix listed |
| cisco ios | = 12.0sc | No fix listed |
| cisco ios | = 12.0sl | No fix listed |
| cisco ios | = 12.0st | No fix listed |
| cisco ios | = 12.0t | No fix listed |
| cisco ios | = 12.0wc | No fix listed |
| cisco ios | = 12.0wt | No fix listed |
| cisco ios | = 12.0xa | No fix listed |
Show 66 more
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco ios | = 12.0xb | No fix listed |
| cisco ios | = 12.0xc | No fix listed |
| cisco ios | = 12.0xd | No fix listed |
| cisco ios | = 12.0xe | No fix listed |
| cisco ios | = 12.0xf | No fix listed |
| cisco ios | = 12.0xg | No fix listed |
| cisco ios | = 12.0xh | No fix listed |
| cisco ios | = 12.0xi | No fix listed |
| cisco ios | = 12.0xj | No fix listed |
| cisco ios | = 12.0xl | No fix listed |
| cisco ios | = 12.0xm | No fix listed |
| cisco ios | = 12.0xn | No fix listed |
| cisco ios | = 12.0xp | No fix listed |
| cisco ios | = 12.0xq | No fix listed |
| cisco ios | = 12.0xr | No fix listed |
| cisco ios | = 12.0xs | No fix listed |
| cisco ios | = 12.0xu | No fix listed |
| cisco ios | = 12.0xv | No fix listed |
| cisco ios | = 12.1 | No fix listed |
| cisco ios | = 12.1aa | No fix listed |
| cisco ios | = 12.1cx | No fix listed |
| cisco ios | = 12.1da | No fix listed |
| cisco ios | = 12.1db | No fix listed |
| cisco ios | = 12.1dc | No fix listed |
| cisco ios | = 12.1e | No fix listed |
| cisco ios | = 12.1ec | No fix listed |
| cisco ios | = 12.1ex | No fix listed |
| cisco ios | = 12.1ey | No fix listed |
| cisco ios | = 12.1ez | No fix listed |
| cisco ios | = 12.1t | No fix listed |
| cisco ios | = 12.1xa | No fix listed |
| cisco ios | = 12.1xb | No fix listed |
| cisco ios | = 12.1xc | No fix listed |
| cisco ios | = 12.1xd | No fix listed |
| cisco ios | = 12.1xe | No fix listed |
| cisco ios | = 12.1xf | No fix listed |
| cisco ios | = 12.1xg | No fix listed |
| cisco ios | = 12.1xh | No fix listed |
| cisco ios | = 12.1xi | No fix listed |
| cisco ios | = 12.1xj | No fix listed |
| cisco ios | = 12.1xk | No fix listed |
| cisco ios | = 12.1xl | No fix listed |
| cisco ios | = 12.1xm | No fix listed |
| cisco ios | = 12.1xp | No fix listed |
| cisco ios | = 12.1xq | No fix listed |
| cisco ios | = 12.1xr | No fix listed |
| cisco ios | = 12.1xs | No fix listed |
| cisco ios | = 12.1xt | No fix listed |
| cisco ios | = 12.1xu | No fix listed |
| cisco ios | = 12.1xv | No fix listed |
| cisco ios | = 12.1xw | No fix listed |
| cisco ios | = 12.1xx | No fix listed |
| cisco ios | = 12.1xy | No fix listed |
| cisco ios | = 12.1xz | No fix listed |
| cisco ios | = 12.1ya | No fix listed |
| cisco ios | = 12.1yb | No fix listed |
| cisco ios | = 12.1yc | No fix listed |
| cisco ios | = 12.1yd | No fix listed |
| cisco ios | = 12.1yf | No fix listed |
| cisco ios | = 12.2 | No fix listed |
| cisco ios | = 12.2t | No fix listed |
| cisco ios | = 12.2xa | No fix listed |
| cisco ios | = 12.2xd | No fix listed |
| cisco ios | = 12.2xe | No fix listed |
| cisco ios | = 12.2xh | No fix listed |
| cisco ios | = 12.2xq | No fix listed |
References
- CA-2001-14 exploit patch third-party-advisory us-government-resource
- L-106 government-resource third-party-advisory
- 20010627 IOS HTTP authorization vulnerability exploit patch vendor-advisory
- 578 vdb-entry
- 20010702 Cisco IOS HTTP Configuration Exploit mailing-list
- 20010702 ios-http-auth.sh mailing-list
- 20010629 Re: Cisco Security Advisory: IOS HTTP authorization vulnerability mailing-list
- 20010702 Cisco device HTTP exploit... mailing-list
- 2936 exploit patch vdb-entry vendor-advisory
- cisco-ios-admin-access(6749) vdb-entry