CVE-2009-0637

Name: CVE-2009-0637
Creator: NVD / NIST
Published: 2009-03-27T16:30:02.127+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 3.32%

Last modified Jun 16, 2026

CVE-2009-0637 is a vulnerability of currently unknown severity. The SCP server in Cisco IOS 12.2 through 12.4, when Role-Based CLI Access is enabled, does not enforce the CLI view configuration for file transfers, which allows remote authenticated users with an attached CLI view to (1) read or (2) overwrite arbitrary files via an SCP command.. EPSS estimates a 3.32% chance of exploitation in the next 30 days.

Description

The SCP server in Cisco IOS 12.2 through 12.4, when Role-Based CLI Access is enabled, does not enforce the CLI view configuration for file transfers, which allows remote authenticated users with an attached CLI view to (1) read or (2) overwrite arbitrary files via an SCP command.

Metrics

EPSS Probability

3.32%

87.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-264

Affected Software

Vendor	Product	Versions
Cisco	Ios	12.2
Cisco	Ios	12.2b
Cisco	Ios	12.2bc
Cisco	Ios	12.2bw
Cisco	Ios	12.2bx
Cisco	Ios	12.2by
Cisco	Ios	12.2bz
Cisco	Ios	12.2ca
Cisco	Ios	12.2cx
Cisco	Ios	12.2cy
Cisco	Ios	12.2cz
Cisco	Ios	12.2da
Cisco	Ios	12.2dd
Cisco	Ios	12.2dx
Cisco	Ios	12.2ew
Cisco	Ios	12.2ewa
Cisco	Ios	12.2ex
Cisco	Ios	12.2ey
Cisco	Ios	12.2ez
Cisco	Ios	12.2fx
Cisco	Ios	12.2fy
Cisco	Ios	12.2fz
Cisco	Ios	12.2irb
Cisco	Ios	12.2ixa
Cisco	Ios	12.2ixb
Cisco	Ios	12.2ixc
Cisco	Ios	12.2ixd
Cisco	Ios	12.2ixe
Cisco	Ios	12.2ixf
Cisco	Ios	12.2ixg
Cisco	Ios	12.2ja
Cisco	Ios	12.2jk
Cisco	Ios	12.2l
Cisco	Ios	12.2mb
Cisco	Ios	12.2mc
Cisco	Ios	12.2rc
Cisco	Ios	12.2s
Cisco	Ios	12.2sb
Cisco	Ios	12.2sbc
Cisco	Ios	12.2sca
Cisco	Ios	12.2sga
Cisco	Ios	12.2sm
Cisco	Ios	12.2so
Cisco	Ios	12.2sr
Cisco	Ios	12.2sra
Cisco	Ios	12.2srb
Cisco	Ios	12.2src
Cisco	Ios	12.2su
Cisco	Ios	12.2sv
Cisco	Ios	12.2sva

Showing 50 of 187 affected configurations. See NVD for the full list.

References

http://secunia.com/advisories/34438Vendor Advisory
http://securitytracker.com/id?1021899Third Party Advisory, VDB Entry
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtmlVendor Advisory
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904c8.shtmlVendor Advisory
http://www.securityfocus.com/bid/34247Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2009/0851Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/49423Third Party Advisory, VDB Entry
http://secunia.com/advisories/34438Vendor Advisory
http://securitytracker.com/id?1021899Third Party Advisory, VDB Entry
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtmlVendor Advisory
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904c8.shtmlVendor Advisory
http://www.securityfocus.com/bid/34247Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2009/0851Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/49423Third Party Advisory, VDB Entry

Timeline

Published: Mar 27, 2009
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2009-0637?

How severe is CVE-2009-0637?

Severity scoring for CVE-2009-0637 is pending analysis. The EPSS model estimates a 3.32% probability of exploitation in the next 30 days.

How do I fix CVE-2009-0637?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-0637?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST