HTTP: Cisco IOS HTTP Configuration Administrative Access

This signature detects connection requests to the Cisco IOS management interface through HTTP. Numerous vulnerabilities in the HTTP interface allow remote attackers, if successful, to gain complete control of the router.

Extended Description

IOS is router firmware developed and distributed by Cisco Systems. IOS functions on numerous Cisco devices, including routers and switches. It is possible to gain full remote administrative access on devices using affected releases of IOS. By using a URL of http://router.address/level/$NUMBER/exec/.... where $NUMBER is an integer between 16 and 99, it is possible for a remote user to gain full administrative access. This problem makes it possible for a remote user to gain full administrative privileges, which may lead to further compromise of the network or result in a denial of service.

Affected Products

Cisco ios

References

BugTraq: 2936

CVE: CVE-2001-0537

URL: http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html

Short Name

HTTP:CISCO:IOS-ADMIN-ACCESS

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Cisco IOS HTTP Configuration Administrative Access

Extended Description

Affected Products

References

Found a potential security threat?