Impact Analysis

If exploited, this vulnerability could allow an attacker to gain access to sensitive device configuration information without authentication.

This exposure of confidential information could lead to further attacks or unauthorized access to network devices.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Cisco IOS XE Software for Cisco Meraki devices. It allows a remote, unauthenticated attacker to view confidential device information by exploiting the fact that device configuration uploads are performed over an insecure tunnel.

An attacker can carry out an on-path attack between the affected device and the Cisco Meraki Dashboard, intercepting sensitive device configuration information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a remote, unauthenticated attacker to view sensitive device configuration information by exploiting an insecure tunnel used for device configuration uploads. Such unauthorized disclosure of confidential information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of sensitive data against unauthorized access and disclosure.

Because the vulnerability involves cleartext transmission of sensitive information (CWE-319), it increases the risk of data breaches that could violate confidentiality requirements under these standards.

Organizations using affected Cisco IOS XE devices with Meraki dashboard management should consider this vulnerability a risk to compliance and should remediate it by upgrading to fixed software releases as recommended by Cisco.

Useful 0 Not Useful 0

Detection Guidance

The presence of a Meraki tunnel, which is related to this vulnerability, can be verified using the CLI command to check if the tunnel is connected, up, and registered.

• Use the command `show meraki connect brief` on affected Cisco IOS XE devices to determine if the Meraki tunnel is active.

Useful 0 Not Useful 0

Mitigation Strategies

There are no workarounds available for this vulnerability. Cisco strongly recommends upgrading affected devices to fixed software releases to fully remediate the issue.

Customers can use the Cisco Software Checker tool to identify vulnerable software versions and the earliest fixed releases.

If you do not have a direct Cisco service contract or cannot obtain fixed software through your point of sale, contact Cisco TAC with product serial numbers and advisory URLs for assistance.

Useful 0 Not Useful 0