CVEvulnerability
CVE-2014-7990
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-11-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:L/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
Cisco IOS XE 3.5E and earlier on WS-C3850, WS-C3860, and AIR-CT5760 devices does not properly parse the "request system shell" challenge response, which allows local users to obtain Linux root access by leveraging administrative privilege, aka Bug ID CSCur09815.
Affected configurations
• cisco ios xe (<= 3.5e)
• cisco air-ct5760
• cisco ws-c3850
• cisco ws-c3860
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7990 Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=36351 Vendor Advisory
- http://www.securityfocus.com/bid/70968 www.securityfocus.com
- http://www.securitytracker.com/id/1031179 www.securitytracker.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98529 exchange.xforce.ibmcloud.com
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7990 Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=36351 Vendor Advisory
- http://www.securityfocus.com/bid/70968 www.securityfocus.com
- http://www.securitytracker.com/id/1031179 www.securitytracker.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98529 exchange.xforce.ibmcloud.com