Cisco IOS XE Software Secure Boot Bypass Vulnerability Allowing Persistent Code Execution

A vulnerability in Cisco IOS XE Software could enable an authenticated, local attacker with level-15 privileges, or an unauthenticated attacker with physical access to the device, to execute persistent code at boot time, thereby disrupting the chain of trust. This vulnerability arises from improper validation of software packages, allowing an attacker to place a crafted file in a specific location on the device. Exploitation of this vulnerability could lead to the execution of persistent code on the underlying operating system, bypassing a critical security feature of the device.

Impact

Exploitation of this vulnerability allows for the execution of persistent code on the underlying operating system, bypassing a major security feature of the device.

Remediation

Cisco has released software updates to address this vulnerability. To determine the appropriate update, users can consult the Cisco Software Checker tool, which identifies security advisories impacting specific software releases and the earliest release that fixes those vulnerabilities.