#VU24161 Cross-site request forgery in Cisco IOS and Cisco IOS XE - CVE-2019-16009

Cybersecurity Help s.r.o.

Published: 2020-01-09

Vulnerability identifier: #VU24161

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-16009

CWE-ID: CWE-352

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco IOS
Operating systems & Components / Operating system
Cisco IOS XE
Operating systems & Components / Operating system

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the web UI. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Cisco IOS: 12.0, 12.1, 12.2 - 12.2.33, 12.3, 12.4 - 12.4.24 T4, 15.0, 15.1(2.0) - 15.1, 15.2EA - 15.2(7)E, 15.3S - 15.3.3 JA12, 15.4S - 15.4.2 S, 15.5S - 15.5.3 S2.9, 15.6T - 15.6.3 M1, 15.8.3 M1 - 15.8.3.1s M

Cisco IOS XE: 3.1, 3.2, 3.2.0 SE, 3.3, 3.4, 3.5, 3.6E, 3.6, 3.6.2 E, 3.6.4 E, 3.6.7 E, 3.7E, 3.7, 3.7.0E, 3.7.1E, 3.7.2E, 3.7.3E, 3.7.3 E, 3.7.4E, 3.7.4 E, 3.7.5E, 3.8E, 3.8, 3.8.0 E, 3.8.1 E, 3.9E, 3.9, 3.9.0 E, 3.10S - 3.10, 3.11, 3.12, 3.13, 3.14, 3.15S, 3.15, 3.16S, 3.16, 3.16.1aS, 3.17S, 3.17, 3.18, 5.1.3, 5.1.3.12i.FWDG, 5.1.4, 5.2.0, 5.2.0.21i.FWDG, 5.2.1, 5.2.2, 5.2.21, 7.0.3 IBB6.0, 7.0.3 IBB6.0.2, 7.0.3 INF7.0, 7.0.3 IGH7.0, 7.0.3 IGC7.0, 7.0.3 INF7.0.6, 7.0.3 IGC7.0.15, 7.0.3 IGH7.0.23, 7.0.3 I7.0.110, 7.0.3 I7.1, 8.0.152.5, 8.0.152.6, 8.2.167.6, 8.2.167.7, 8.3.0 SK.0.39, 8.3.134.81, 8.3.134.86, 8.3.134.87, 8.3.134.90, 8.3.135.3, 8.3.140.0, 8.5.107.104, 8.5.107.105, 8.5.110.0, 8.6.1.178, 8.6.1.179, 8.6.101.0, 8.7.1.131, 8.7.1.133, 8.8.1.57, 8.8.1.58, 10.2.171.47, 11.3.1, 11.3.3, 12.2.33 CY2, 12.2.33 SRE7a, 12.2.33 SRE10, 12.2.55 SE, 12.2.55 SE3, 12.2.55 EX3, 12.2.55 SE4, 12.2.55 SE5, 12.2.55 SE6, 12.2.55 SE7, 12.2.55 SE8, 12.2.55 SE9, 12.2.55 SE10, 12.2.55 SE11, 12.2.58 EY, 12.2.58 EZ, 12.2.58 SE, 12.2.58 SE1, 12.2.58 SE2, 12.2.60 EZ, 12.2.60 EZ1, 12.2.60 EZ2, 12.2.60 EZ3, 12.2.60 EZ4, 12.2.60 EZ5, 12.2.60 EZ9, 12.2.60 EZ13, 15.0.1 SE, 15.0.1 SE1, 15.0.1 EY2, 15.0.1 SE2, 15.0.1 SE3, 15.0.1.9.1 SQD8, 15.0.1.15 UCT, 15.0.1.20 EZD, 15.0.2 EY, 15.0.2 EB, 15.0.2 EH, 15.0.2 EZ, 15.0.2 ED, 15.0.2 EC, 15.0.2 EJ, 15.0.2 EA, 15.0.2 SE, 15.0.2 EX, 15.0.2 EK, 15.0.2 EK1, 15.0.2 EY1, 15.0.2 EX1, 15.0.2 ED1, 15.0.2 EJ1, 15.0.2 EA1, 15.0.2 SE1, 15.0.2 SE2, 15.0.2 EY2, 15.0.2 SE3, 15.0.2 EX3, 15.0.2 SE4, 15.0.2 EX4, 15.0.2 EX5, 15.0.2 SE5, 15.0.2 SE6, 15.0.2 SE9, 15.0.2 EX10, 15.0.2 SE10, 15.0.2 SG11, 15.0.2 EX11, 15.0.2.1.91 SG11, 15.0.2.1.94 SG11, 15.0.2.26 DPB1.47, 15.0.4.1 SID, 15.0.4.4 DPB1, 15.0.5.0 SG1, 15.0.5.0.26 SG, 15.0.5.59 EMD, 15.0.6.97 EMD, 15.0.7.1 EMW, 15.0.9.0 PKD, 15.0.9.2 EMD, 15.0.9.4 EMW, 15.0.10.16 EMW, 15.1.0.9 SG3, 15.1.1 SY, 15.1.1 SG, 15.1.1 SY0.1, 15.1.1 SY1, 15.1.1 SG1, 15.1.1 SY1.32, 15.1.1 SY1.55, 15.1.1 SY1.57, 15.1.1 SY2, 15.1.1 SG2, 15.1.1 SG2.1.1, 15.1.1 SY3, 15.1.1 SY4.28, 15.1.1 SY5, 15.1.1 SG5.63, 15.1.1 SG5.64, 15.1.1 SG5.78.11, 15.1.1 SG5.83.1, 15.1.1 SG5.98, 15.1.1 SG5.103, 15.1.1 SG5.124, 15.1.1 SG5.163, 15.1.1 SG5.169, 15.1.1 SG5.170, 15.1.1 SG5.251, 15.1.1 SG5.252, 15.1.1.4 DPB18, 15.1.1.5 SID, 15.1.1.33 SID, 15.1.2 SG, 15.1.2 SY, 15.1.2 SY1, 15.1.2 SG1, 15.1.2 SG1.0.79, 15.1.2 SGN1.64, 15.1.2 SG1.129, 15.1.2 SY2, 15.1.2 SG2, 15.1.2 SG3, 15.1.2 SY3, 15.1.2 SG3.0.1, 15.1.2 SG4, 15.1.2 SG7, 15.1.2 SG8, 15.1.2 STV11.1, 15.1.2 SIV11.7, 15.1.2 SY11.60, 15.1.2 SY11.61, 15.1.2 SY11.62, 15.1.2 SY11.64, 15.1.3 T2, 15.1.3 T3, 15.1.3 T4, 15.1.4 GC, 15.1.4 GC1, 15.1.4 GC2, 15.1.4 M2, 15.1.4 M3, 15.1.4 M3.2, 15.1.4 M4, 15.1.4 XB5a, 15.1.4 M5, 15.1.4 M5.14, 15.1.4 M6, 15.1.4 M7, 15.1.4 XB7, 15.1.4 M8, 15.1.4 M9, 15.2.0.13.9 PIB17, 15.2.0.17.3 PIA17, 15.2.0.19 T, 15.2.1 E, 15.2.1 EY, 15.2.1 T, 15.2.1 EX0.5, 15.2.1 EX0.116, 15.2.1 T1, 15.2.1 E1, 15.2.1 T1.12, 15.2.1 SY1.13, 15.2.1 T2, 15.2.1 E2, 15.2.1 SY2, 15.2.1 GC2, 15.2.1 E3, 15.2.1 T3.2, 15.2.1 T4, 15.2.1 SY5.94, 15.2.1 SY5.97, 15.2.1 SY5.98, 15.2.1 SY5.105, 15.2.1 SY5.114, 15.2.1 SY6, 15.2.1.0.0 IPI2, 15.2.1.0.1 IPI2, 15.2.1.1 EY, 15.2.1.1, 15.2.1.2.3 PI22, 15.2.2 T, 15.2.2 E, 15.2.2 JB, 15.2.2 JAX, 15.2.2 JA, 15.2.2 GC, 15.2.2 T0.2, 15.2.2 T1, 15.2.2 JA1, 15.2.2 EB2, 15.2.2 JB2, 15.2.2 JB3, 15.2.2 T3, 15.2.2 EA3, 15.2.2 E4, 15.2.2 JB4, 15.2.2 T4, 15.2.2 E5a, 15.2.2 E5, 15.2.2 E7, 15.2.2 E8, 15.2.2a JA, 15.2.2.0.2 EA3, 15.2.2.9.5 PIH18, 15.2.2.10 T, 15.2.2.14 PI19, 15.2.3m E7, 15.2.3m E8, 15.2.3 E, 15.2.3 GC, 15.2.3 GCA, 15.2.3 T, 15.2.3 T1, 15.2.3 GC1, 15.2.3 GCA1, 15.2.3 T2, 15.2.3 T2.1, 15.2.3 E3, 15.2.3 T3, 15.2.3 T4, 15.2.3 E4, 15.2.3.30 PIP, 15.2.4m E2, 15.2.4 JB, 15.2.4 JAZ, 15.2.4 GC, 15.2.4 E, 15.2.4 JA, 15.2.4 JA1, 15.2.4 GC1, 15.2.4 E1, 15.2.4 JB1, 15.2.4 M1, 15.2.4 GC2, 15.2.4 E2, 15.2.4 M2, 15.2.4 M2.5, 15.2.4 JB3s, 15.2.4 JB3a, 15.2.4 JB3b, 15.2.4 E3, 15.2.4 M3, 15.2.4 JB3, 15.2.4 JB4, 15.2.4 EA4, 15.2.4 M4, 15.2.4 JB5m, 15.2.4 EA5, 15.2.4 JB5, 15.2.4 E5, 15.2.4 M5, 15.2.4 S5, 15.2.4 M6a, 15.2.4 M6b, 15.2.4 JB6, 15.2.4 M6, 15.2.4 EA6, 15.2.4 XB11, 15.2.4.0r EB, 15.2.4.0 ST, 15.2.4.0.21 E, 15.2.4.0.64a E, 15.2.4.0.95a E, 15.2.4.1.5a E, 15.2.4.1.13 E, 15.2.4.1.27 EB, 15.2.4.3.90 EC, 15.2.4.4.3 EA4, 15.2.4.6.22 EA5, 15.2.4.7.1 EC, 15.2.4.7.2 EC, 15.2.4.7.3 EA7, 15.2.4.7.5 EA7, 15.2.4.7.6 EA7, 15.2.4.7.8 EA7, 15.2.4.7.10 EA7, 15.2.4.7.12 EA7, 15.2.4.7.14 EA7, 15.2.5 E, 15.2.5 EX, 15.2.5 E1, 15.2.5 E2, 15.2.5a E, 15.2.5b E, 15.2.5.0 ST, 15.2.5.0.73 E, 15.2.5.1.3 E, 15.2.5.1.79i E, 15.2.5.3.27i E1, 15.2.5.3.29i E1, 15.2.5.4.1i E2, 15.2.5.5.63 E, 15.2.5.5.64 E, 15.2.5.6.56 EA, 15.2.5.7.2 EA, 15.2.5.8.1 EA, 15.2.6 E, 15.2.6 E0c, 15.2.6 E1, 15.2.6.2.6i E, 15.2.6.2.16i E, 15.2.6.2.20i E, 15.2.6.2.72i E, 15.2.6.3.0i E, 15.2.6.3.30i E, 15.2.6.3.46i E, 15.2.6.4.0i E1, 15.2.6.4.4i E1, 15.2.6.4.62i E1, 15.2.6.4.63i E1, 15.2.6.4.66i E1, 15.2.6.4.85i E1, 15.2.6.5.1i E1, 15.2.6.5.9i E1, 15.3.0.0.19 SY, 15.3.1 T, 15.3.1 T0.1, 15.3.1 T1, 15.3.1 T2, 15.3.1 T3, 15.3.1 T4, 15.3.1 IE101.209, 15.3.1.9 T, 15.3.1.13 T, 15.3.1.13.1 PIH21, 15.3.1.14 PI22, 15.3.2 T, 15.3.2 T1, 15.3.2 T2, 15.3.2 T3, 15.3.2 T4, 15.3.2.3.1 CG, 15.3.3 M, 15.3.3 JF, 15.3.3 JG, 15.3.3 JNB, 15.3.3 JE, 15.3.3 S, 15.3.3 M0.4, 15.3.3 JA1m, 15.3.3 JNB1, 15.3.3 JA1, 15.3.3 M1, 15.3.3 S1.4, 15.3.3 S2t, 15.3.3 S2a, 15.3.3 M2, 15.3.3 JF2, 15.3.3 S2, 15.3.3 JA2, 15.3.3 JD3, 15.3.3 M3, 15.3.3 JA3, 15.3.3 JN4, 15.3.3 JD5, 15.3.3 JPC5, 15.3.3 JPC6, 15.3.3 JC6, 15.3.3 JPC7, 15.3.3 JD7, 15.3.3 JA10, 15.3.3 JA11, 15.3.3 JDA12, 15.3.3 XB12, 15.3.3 JD12, 15.3.3 JD13, 15.3.3 JDA13, 15.3.3 JA77, 15.4.0.23 T, 15.4.1 CG, 15.4.1 T, 15.4.1 S, 15.4.1 S0e, 15.4.1 T1, 15.4.1 CG1, 15.4.1 IA1.1, 15.4.1 IA1.100, 15.4.1 IA1.102, 15.4.1 IC1.126, 15.4.1 IA1.201, 15.4.1 SY2, 15.4.1 T2, 15.4.1 SY3, 15.4.1 SY4, 15.4.1.1.13 SY3, 15.4.1.1.20 SY4, 15.4.1.1.21 SY4, 15.4.1.1.22 SY4, 15.4.1.1.28 SY3, 15.4.1.8 S, 15.4.1.9.1 XEB, 15.4.1.9.2 XEB, 15.4.1.12 T, 15.4.1.13 S, 15.4.2 SN, 15.4.2 T, 15.4.2 S, 15.4.2 CG, 15.4.2 S1, 15.4.2 SN1, 15.4.2 T1, 15.4.2.1.1 S, 15.4.3 M, 15.4.3 S, 15.4.3 M4.1, 15.4.3 M6, 15.4.3 S6.1, 15.4.3 S6.2, 15.4.3 S7, 15.4.3 M7, 15.4.3 M8, 15.4.3 S8.7, 15.4.3 S9, 15.4.3 M9, 15.4.3.0i M6, 15.5.0 IA1.1, 15.5.0 IA101.142, 15.5.1 SY1, 15.5.1 IC1.73, 15.5.1 IC1.112, 15.5.1 IA1.363, 15.5.1 IA1.428, 15.5.1 IA1.509, 15.5.1 IA1.511, 15.5.1 IA1.516, 15.5.1 IA1.529, 15.5.1.0.91 SY1, 15.5.1.0.93 SY1, 15.5.3 S, 15.5.3 S1.1, 15.5.3 S1.2, 15.5.3 S1.4, 15.5.3 S1.5, 15.5.3 S1.7, 15.5.3 S1.8, 15.5.3 S1.9, 15.5.3 S1.10, 15.5.3 S1.11, 15.5.3 S1.12, 15.5.3 M2.1, 15.5.3 S3.16, 15.5.3 M4.1, 15.5.3 S4.1, 15.5.3 M5, 15.5.3 S5, 15.5.3 S5.31, 15.5.3 S6a, 15.5.3 M6, 15.5.3 S6, 15.5.3 M6.1, 15.5.3 S6.1, 15.5.3 S6.13, 15.5.3 S6.15, 15.5.3 S6.21, 15.5.3 S6.23, 15.5.3 M7, 15.5.4 IA1.1, 15.6.1 SN, 15.6.1 S2.18, 15.6.1 S4.2, 15.6.1.9 SP1, 15.6.1.17 S0.47, 15.6.1.22 T, 15.6.1.28 SP2, 15.6.1.41 SP2, 15.6.2 SP, 15.6.2 T0.1, 15.6.2 SP1, 15.6.2 T2, 15.6.2 T3, 15.6.2 SP3, 15.6.2 S4, 15.6.2 SP4, 15.6.2.0.1a T0, 15.6.2.3 T, 15.6.2.10 SP3, 15.6.2.12.1a T0, 15.6.2.13 SP3, 15.6.2.14 SP3, 15.6.2.18 S2.21, 15.6.2.18 S2.23, 15.6.2.18 SP3, 15.6.2.19 T, 15.6.3 M, 15.6.3 M1, 15.6.3 M2.2, 15.6.3 M3, 15.6.3 M3.1, 15.6.3 M4, 15.6.3.0p M, 15.7.0.2 M, 15.7.2.0y M, 15.7.2.0r M, 15.7.2.0k M, 15.7.2.0v M0.2, 15.7.2.0v M0.6, 15.7.3 M, 15.7.3 M1, 15.7.3.0t M, 15.7.3.0u M, 15.7.3.0z M, 15.7.3.1.4A OT, 15.7.3.1.4N OT, 15.7.3.1.5U OT, 15.7.3.1.8A OT, 15.7.3.1.9T OT, 15.7.3.1.9W OT, 15.7.3.1.10U OT, 15.7.3.1.10V OT, 15.7.3.1.11D OT, 15.7.3.1.14A OT, 16.1

External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ios-csrf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Latest bulletins with this vulnerability

Cross-site request forgery in Cisco IOS and Cisco IOS XE