Cisco IOS XE Software Secure Boot Bypass Vulnerability Allowing Persistent Code Execution

A vulnerability exists in Cisco IOS XE Software that could enable an authenticated, local attacker with level-15 privileges, or an unauthenticated attacker with physical access to the device, to execute persistent code at boot time, thereby disrupting the chain of trust. This issue arises from improper validation of software packages, allowing an attacker to place a crafted file in a specific location on the device. Exploitation of this vulnerability could lead to the execution of persistent code on the underlying operating system.

Impact

Exploitation of this vulnerability allows for persistent code execution at boot time, bypassing a critical security feature and breaking the device's chain of trust.

Remediation

Cisco has released software updates to address this vulnerability. Instructions for upgrading can be found on the Cisco Support and Downloads page. Customers without a Cisco service contract should contact the Cisco Technical Assistance Center (TAC) for assistance.