Qualys has published a dashboard widget to help organizations visualize their exposure to the new Cisco REST API Container for IOS XE Software Authentication Bypass Vulnerability (CVE-2019-12643).
This vulnerability could allow a remote attacker to bypass authentication on devices running an outdated version of Cisco REST API virtual service container. The security issue is tracked as CVE-2019-12643 and has received a maximum severity rating score of 10 based on CVSS v3 Scoring system.
Steps for detection and remediation, including reference to this dashboard widget, are detailed in the Qualys Blog at Cisco REST API Container for IOS XE Software Authentication Bypass Vulnerability – (CVE-2019-12643).
As shown below, the widget shows the number of affected systems detected per day so that you can visually track progress towards remediation of this vulnerability across your organization.
You can search for this new QID in AssetView or within the VM Dashboard by using the following QQL query:
The widget can be imported into the VM Dashboard Beta in your Qualys subscription, and is attached to this document as REST_API_Container_for_IOS_XE_Software_Auth_Bypass_VMwidget.json.zip.
NVD Vulnerability Severity Ratings
NVD provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification.
|CVSS v3.0 Ratings|
|Severity||Base Score Range|
How to Enable Trending on the Widgets
Open the desired widget in edit mode and select the Collect trend data checkbox.
* * * WARNING: Read Before Downloading * * *
At this time, Dashboard and Widget JSON files are not interchangeable between application dashboards, meaning Vulnerability Management Beta Dashboard JSON files may only be used in VM Dashboard and AssetView JSON
Again, there is no way to reverse this mistake within the UI, it must be done in the database.