CVE-2001-0537

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.cert.org/advisories/CA-2001-14.htmlExploit, Patch, Third Party Advisory, US Government Resource
http://www.ciac.org/ciac/bulletins/l-106.shtml
http://www.cisco.com/warp/public/707/IOS-httplevel-pub.htmlExploit, Patch, Vendor Advisory
http://www.osvdb.org/578
http://www.securityfocus.com/archive/1/1601227034.20010702112207%40olympos.org
http://www.securityfocus.com/archive/1/20010703011650.60515.qmail%40web14910.mail.yahoo.com
http://www.securityfocus.com/archive/1/4.3.2.7.2.20010629095801.0c3e6a70%40brussels.cisco.com
http://www.securityfocus.com/archive/1/Pine.LNX.3.96.1010702134611.22995B-100000%40Lib-Vai.lib.asu.edu
http://www.securityfocus.com/bid/2936Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6749
http://www.cert.org/advisories/CA-2001-14.htmlExploit, Patch, Third Party Advisory, US Government Resource
http://www.ciac.org/ciac/bulletins/l-106.shtml
http://www.cisco.com/warp/public/707/IOS-httplevel-pub.htmlExploit, Patch, Vendor Advisory
http://www.osvdb.org/578
http://www.securityfocus.com/archive/1/1601227034.20010702112207%40olympos.org
http://www.securityfocus.com/archive/1/20010703011650.60515.qmail%40web14910.mail.yahoo.com
http://www.securityfocus.com/archive/1/4.3.2.7.2.20010629095801.0c3e6a70%40brussels.cisco.com
http://www.securityfocus.com/archive/1/Pine.LNX.3.96.1010702134611.22995B-100000%40Lib-Vai.lib.asu.edu
http://www.securityfocus.com/bid/2936Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6749

Timeline

Published: Jul 21, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-053810.0Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a mal CVE-2001-05405.0Memory leak in Terminal servers in Windows NT and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via CVE-2001-05417.5Buffer overflow in Microsoft Windows Media Player 7.1 and earlier allows remote attackers to execute arbitrary commands via a malformed Wind CVE-2001-05427.5Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functi CVE-2001-05435.0Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via CVE-2001-05442.1IIS 5.0 allows local users to cause a denial of service (hang) via by installing content that produces a certain invalid MIME Content-Type h CVE-2001-05455.0IIS 4.0 with URL redirection enabled allows remote attackers to cause a denial of service (crash) via a malformed request that specifies a l CVE-2001-05465.0Memory leak in H.323 Gatekeeper Service in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a CVE-2001-05472.1Memory leak in the proxy service in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows local attackers to cause a denial CVE-2001-05484.6Buffer overflow in dtmail in Solaris 2.6 and 7 allows local users to gain privileges via the MAIL environment variable.CVE-2001-05494.6Symantec LiveUpdate 1.5 stores proxy passwords in cleartext in a registry key, which could allow local users to obtain the passwords.CVE-2001-05507.5wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handl