CVE-2001-0537

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute...

9.3 HighPublic exploit

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.

Exploit likelihood

68.5%Down 13.1 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.

Record: CVE-2001-0537
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.

Record: CVE-2001-0537
Updated: 2026-11-02

EUVDEUVD-2001-0529 No score

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.

Record: EUVD-2001-0529
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3m99-vrqx-m6h7 No score

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute...

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL.

Record: GHSA-3m99-vrqx-m6h7
Weakness: CWE-287
Updated: 2026-11-02

Affected products

cisco ios

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Cisco IOS 11.x/12.x - HTTP Configuration Arbitrary Administrative Access (1)	2001-06-27
Exploit-DB	Cisco IOS 11.x/12.x - HTTP Configuration Arbitrary Administrative Access (2)	2001-06-27
Exploit-DB	Cisco IOS 11.x/12.x - HTTP Configuration Arbitrary Administrative Access (3)	2001-03-07
Exploit-DB	Cisco IOS 11.x/12.x - HTTP Configuration Arbitrary Administrative Access (4)	2001-06-27
Metasploit	Cisco IOS HTTP Unauthorized Administrative Access	2001-06-27
Nuclei	Cisco IOS HTTP Configuration - Authentication Bypass

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2001-0537 is a high vulnerability (CVSS 9.3) in Cisco Ios, published July 21, 2001. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 68.5%, the 99th percentile. No source names a fixed version.

References

Show 10 moreShow less