Cisco IOS XE Software HTTP API Command Injection Vulnerability

TL;DR 📌

A command injection vulnerability has been identified in the HTTP API subsystem of Cisco IOS XE Software. This flaw could allow an attacker to execute commands with root privileges, posing a significant security risk. Users are advised to upgrade to fixed software as there are no workarounds available.

What happened 🕵️‍♂️

Cisco has disclosed a vulnerability in the HTTP API subsystem of Cisco IOS XE Software that could allow a remote attacker to inject commands that execute with root privileges. This vulnerability arises from insufficient input validation. An attacker with administrative privileges could exploit this by authenticating to an affected system and making an API call with crafted input. Alternatively, an unauthenticated attacker could trick a legitimate user with administrative privileges into clicking a malicious link. Successful exploitation could lead to arbitrary command execution as the root user.

Affected products 🖥️

This vulnerability affects Cisco devices running a vulnerable release of Cisco IOS XE Software with the HTTP Server feature enabled. To check if the HTTP Server feature is enabled, use the command show running-config | include ip http server|secure|active in the CLI. If either the ip http server or ip http secure-server command is present, the feature is enabled.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability.

Risk in context 🎯

With a CVSS score of 8.8, this vulnerability is rated as High severity. The risk is heightened due to the potential for remote exploitation, especially if an attacker can trick a legitimate user into executing a malicious command. Organizations should prioritize patching affected systems to mitigate this risk.

Fast facts ⚡

• Vulnerability: Command Injection in HTTP API of Cisco IOS XE Software
• CVSS Score: 8.8 (High)
• Exploitation: Requires administrative privileges or social engineering
• Workarounds: None available
• Fixed Software: Available through Cisco Software Checker

For leadership 🧭

Executive summary. Any Cisco IOS XE device with the HTTP Server feature switched on can be forced into running root-level commands, either by a logged-in administrator’s crafted API call or by tricking that administrator into clicking a malicious link. Because there is no workaround, this needs a patching decision this week rather than a mitigation plan.

Why it matters:

• The flaw sits in the HTTP API subsystem, so any device with ip http server or ip http secure-server enabled is exposed, not just management-plane services.
• Successful exploitation gives an attacker root-level command execution on the network device itself, effectively full control of routing and switching infrastructure.
• The attack works two ways: a directly authenticated admin sending a crafted API call, or an unauthenticated attacker socially engineering an admin into clicking a link, widening the practical attack surface beyond credential theft alone.
• With no workaround published, devices remain vulnerable until the software is upgraded, leaving no interim compensating control to fall back on.

Now / Next / Later:

• Now: Run show running-config | include ip http server|secure|active on every IOS XE device to identify which ones have the HTTP Server feature enabled and are therefore exposed.
• Next: Schedule an upgrade to the first fixed release for each affected IOS XE train, using Cisco’s Software Checker to confirm the correct target version before the change window.
• Later: Where the HTTP API isn’t operationally required, disable the HTTP Server feature by default on IOS XE builds and add a standing check for ip http server/ip http secure-server to routine device configuration audits.