Preview Tool

Cisco Bug: CSCus73013 - Cisco IOS and IOSXE SSHv2 RSA-based User Auth Bypass Vulnerability

Last Modified

Dec 13, 2018

Products (21)

  • Cisco IOS
  • Cisco ASR 901-6CZ-FS-D Router
  • Cisco ASR 901-6CZ-F-D Router
  • Cisco ME 3600X-24TS-M Switch
  • Cisco ASR 901S-4SG-F-D Router
  • Cisco ASR 901-4C-FT-D Router
  • Cisco ASR 901-6CZ-F-A Router
  • Cisco ASR 901S-2SG-F-D Router
  • Cisco ASR 901S-2SG-F-AH Router
  • Cisco ASR 901-6CZ-FT-A Router
View all products in Bug Search Tool Login Required

Known Affected Releases

15.4(2)S 15.4(2)T1.1

Description (partial)

A vulnerability in the SSH version 2 (SSHv2) protocol implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote
attacker to bypass user authentication.

Successful exploitation could allow the attacker to log in with the privileges of the user or the privileges configured for the Virtual Teletype
(VTY) line. Depending on the configuration of the user and of the vty line, the attacker may obtain administrative privileges on the system.  The
attacker cannot use this vulnerability to elevate privileges.

The attacker must know a valid username configured for RSA-based user authentication and the public key configured for that user to exploit this
vulnerability. This vulnerability affects only devices configured for public key authentication method, also known as RSA-based user
authentication feature.

Cisco has released software updates that address this vulnerability. Workarounds for this vulnerability are not available; however administrators
could temporarily disable RSA-based user authentication to avoid exploitation. This advisory is available at the following link:

Note: The September 23, 2015, release of the Cisco IOS and IOS XE Software Security Advisory bundled publication includes three Cisco Security
Advisories. All the advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco
Event Response: September 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication at the following link:

Refer to the security advisory
Bug details contain sensitive information and therefore require a account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.