Sploitus

Exploit for Cisco IOS HTTP access level authentication bypass

saint Β· 2010-12-23

Exploit Code

MARKDOWN33 lines
## https://sploitus.com/exploit?id=SAINT:F74CB7203E00CB3C06F68F8CDCA92561
Added: 12/23/2010  
CVE: [CVE-2001-0537](<https://vulners.com/cve/CVE-2001-0537>)  
BID: [2936](<http://www.securityfocus.com/bid/2936>)  
OSVDB: [578](<http://www.osvdb.org/578>)  


### Background

The Cisco [Internetwork Operating System](<http://www.cisco.com/en/US/products/sw/iosswrel/ps1818/products_tech_note09186a008015083e.shtml>) (IOS) is the operating system used by Cisco routers. 

### Problem

A remote attacker could execute arbitrary commands at the highest privilege level (level 15) without needing to authenticate by requesting a URL of the form `**http://_target_/level/_xx_/exec/_command_**`, where _xx_ is some number between 16 and 99. 

### Resolution

Apply the fix referenced in [cisco-sa-20010627-ios-http-level](<http://www.cisco.com/warp/public/707/cisco-sa-20010627-ios-http-level.shtml>). Alternatively, disable the HTTP interface or use TACACS+ or Radius for authentication. 

### References

<http://www.cert.org/advisories/CA-2001-14.html>  


### Limitations

Exploit works on Cisco IOS 11.3 through 12.2. 

The target must have the HTTP interface enabled and be using local authentication in order for the exploit to succeed. 

### Platforms

Cisco