CVE-2001-0537 CISCO Authentication Bypass.bcheck

metadata:
    language: v1-beta
    name: "CVE-2001-0537 CISCO Authentication Bypass"
    description: "Checks for CVE-2001-0537"
    author: "Ollie Whitehouse"
    tags: "CVE-2001-0537 CVE"

define:
    potential_path =
        "/level/16/exec/show%20privilege"

given host then
    send request called check:
        method: "GET"
        path: {potential_path}

		# Checks that we get a 200 AND that the output we expect in the result
		if {check.response.status_code} is "200" and "Current privilege level is" in {check.response.body} then
			report issue:
				severity: high
				confidence: certain
				detail: "Router is vulnerable to the authentication bypass vulnerability CVE-2001-0537"
				remediation: "Patch to a non vulnerable version"
		end if