Description
The Management Console (webagent.exe) in Cisco Security Agent 5.1, 5.2, and 6.0 before 6.0.2.145 allows remote attackers to create arbitrary files and execute arbitrary code via unspecified parameters in a crafted st_upload request.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Cisco Security Agent Management Console - 'st_upload' Remote Code Execution EDB-17155 · remote · Apr 12, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 8197 third-party-advisory
- 20110216 Management Center for Cisco Security Agent Remote Code Execution Vulnerability vendor-advisory
- 1025088 vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-11-088
- 20110217 ZDI-11-088: Cisco Security Agent Management st_upload Remote Code Execution Vulnerability mailing-list
- 8205 third-party-advisory
- 43383 third-party-advisory
- 8095 third-party-advisory
- 46420 vdb-entry
- ADV-2011-0424 vdb-entry
- 43393 third-party-advisory
- cisco-security-webagent-file-upload(65436) vdb-entry