Description
Cisco IOS XE 3.5E and earlier on WS-C3850, WS-C3860, and AIR-CT5760 devices does not properly parse the "request system shell" challenge response, which allows local users to obtain Linux root access by leveraging administrative privilege, aka Bug ID CSCur09815.
References
- 20141106 Cisco IOS XE Challenge/Response Bypass Vulnerability vendor-advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=36351
- ciscoiosxe-cve20147990-sec-bypass(98529) vdb-entry
- 70968 vdb-entry
- 1031179 vdb-entry