Customers may only install and expect support for software versions and feature sets for which they have purchased a license. If the ip http secure-server command is present and the configuration alsoĬontains ip http secure-active-session-modules none, the vulnerability is notĬisco has released free software updates that address the vulnerability described in this advisory. If the ip http server command is present and the configuration also contains ip http active-session-modules none, the vulnerability is not exploitable over HTTP. Note: The presence of either command, or both commands, in the device configuration indicates that the web UI feature is enabled. The following example shows the output of the show running-config | include ip http server|secure|active command for a device that has the HTTP Server feature enabled: Router# show running-config | include ip http server|secure|active If either command is present and configured, the HTTP Server feature is enabled for the device. To determine whether the HTTP Server feature is enabled for a device, administrators can log in to the device and use the show running-config | include ip http server|secure|active command in the CLI to check for the presence of the ip http server command or the ip http secure-server command in the global configuration.

The default state of the HTTP Server feature in Cisco IOS and Cisco IOS XE Software is version dependent.įor information about which Cisco IOS and Cisco IOS XE Software releases are vulnerable, see the Fixed Software section of this advisory. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS or Cisco IOS XE Software earlier than 16.1.1 with the HTTP Server feature enabled.

Cisco tor switch