There are no workarounds that address this vulnerability. A successful exploit may require the attacker to perform a social engineering attack to persuade the user to initiate communication from the Launcher to the ASDM.Ĭisco has not released software updates that address this vulnerability.
A successful exploit could allow the attacker to execute arbitrary code on the user's operating system with the level of privileges assigned to the ASDM Launcher. An attacker could exploit this vulnerability by leveraging a man-in-the-middle position on the network to intercept the traffic between the Launcher and the ASDM and then inject arbitrary code. This vulnerability is due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. Manage the aggregate of local users on Cisco IOS XR device Note This plugin is part of the cisco.iosxr collection (version 2.4.0). A vulnerability in the Cisco Adaptive Security Device Manager (ASDM) Launcher could allow an unauthenticated, remote attacker to execute arbitrary code on a user's operating system.
0 kommentar(er)
