Cisco IOS and IOS XE Software CLI Denial of Service Vulnerability

TL;DR 📌

A medium-severity vulnerability has been identified in the CLI of Cisco IOS and IOS XE Software, allowing an authenticated local attacker to cause a denial of service (DoS) by exploiting a buffer overflow. No workarounds are available, and Cisco recommends upgrading to fixed software releases.

What happened 🕵️‍♂️

A vulnerability in the CLI of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. This issue arises from a buffer overflow that can be exploited using crafted commands at the CLI prompt. While proof-of-concept exploit code is available, there have been no reports of malicious exploitation.

Affected products 🖥️

This vulnerability affects Cisco IOS and IOS XE Software if the shell processing full command is configured. This command is disabled by default. To check if your device is affected, log in and run the command: show run | include shell. If there is no output, your device is not affected.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no official workarounds that address this vulnerability. However, removing the shell processing full command can eliminate the attack vector. This can be done by entering no shell processing full in global configuration mode. Customers should evaluate the impact of this mitigation in their own environments before implementation.

Risk in context 🎯

The highest CVSS score for this vulnerability is 6.5, categorizing it as Medium severity. The risk is primarily driven by the requirement for local authentication, which limits exposure. However, the potential for denial of service could impact availability, making it essential for affected organizations to prioritize remediation.

Fast facts ⚡

• Vulnerability: CLI Denial of Service
• CVSS Score: 6.5 (Medium)
• Attack Vector: Local (authenticated)
• Impact: Device reload causing DoS
• Workarounds: None officially; removal of shell processing full command is a temporary mitigation.

For leadership 🧭

Executive summary. An authenticated user with local CLI access can force a reload of Cisco IOS or IOS XE devices that have the shell processing full command configured, causing an outage until the device recovers. This is not remotely exploitable and only affects devices with that non-default command enabled, so it warrants scheduled remediation rather than emergency action.

Why it matters:

• The flaw is triggered via crafted commands at the CLI prompt, so any user with authenticated local shell access on an affected device can crash it, not just administrators with full privilege.
• Exposure depends entirely on whether the shell processing full command has been configured, which is disabled by default, so many devices will not be affected at all.
• Impact is a device reload, meaning routers or switches running the affected code could drop out of service and disrupt traffic passing through them.
• No workaround exists beyond removing the shell processing full command, so devices that rely on it for legitimate purposes have no interim fix while they wait for an upgrade.

Now / Next / Later:

• Now: Run show run | include shell on Cisco IOS and IOS XE devices to identify any with shell processing full configured, since only these are exposed.
• Next: On confirmed-affected devices, either remove the shell processing full command with no shell processing full after assessing its impact, or schedule an upgrade to a fixed release during a maintenance window.
• Later: Review why shell processing full is enabled anywhere in the estate and restrict local CLI access to fewer, more trusted accounts to reduce exposure to this class of local authenticated DoS issue.