Cisco warns of HTTP flaw

Cisco has issued an advisory about an unpatched flaw affecting its IOS HTTP server.

The flaw could allow a hacker to view a memory dump (a record of the data in a router’s memory) of an IOS router via the HTTP server and inject script code into the router through the HTTP server.

"A proof of concept exploit exists for this vulnerability, in which the exploit attempts to reset the enable password on the device," warns the company.

"For the attack to work against the device itself, the user browsing tainted dynamic content on the router will only be able to execute commands at or below the privilege level for which they are authenticated and authorised for on the device."

Cisco will issue a patch for the problem as soon as possible and it will be free to customers. In the meantime the advisory gives three possible workarounds to mitigate the flaw.