Risk: Medium
Multiple vulnerabilities have been found in Cisco's IOS FTP server, successful exploitation of which could result in an attacker bypassing security, launching a DoS attack or gaining system access.
An unspecified error exists in the IOS FTP server when verifying user credentials, which can be exploited to bypass user authentication. Another unspecified error exists when transferring files via FTP. Successful exploitation may allow an attacker to retrieve any file from an affected system (including startup-config), cause IOS to reload and potentially execute arbitrary code. However, it does require the FTP server to be enabled, which is not the default setting.
The vulnerabilities exist in IOS version 11.3, 12.0, 12.1, 12.2, 12.3 and 12.4 containing the FTP server feature.