Once initial access is granted to configure the router, the customer may disable or limit access to the HTTP server by changing the configuration. Once the new configuration has been saved, the the HTTP server will not be enabled automatically when the router restarts. Any affected Cisco IOS device that is operating with the HTTP server enabled and is not protected against unauthorized connections can be forced to halt for a period of up to two minutes and then reload. In rare instances when a router at a remote location fails to reload, an administrator must visit the physical device to recover from the defect. The following table summarizes the major releases of Cisco IOS software affected by the defect described in this notice and scheduled dates on which the earliest corresponding fixed releases will be available.
All dates are tentative and subject to change.
A Rebuild Release is constructed from the previous maintenance or mainline release with the addition of a code fix for the specific defect. Although it receives less testing than a maintenance release, it is built from the previous maintenance release and includes only the minimum changes necessary to address the specific defect. An Interim Release has much less testing than a maintenance release and should be selected only if there is no other suitable release that fixes the defect. To find an appropriate replacement for a vulnerable release, compare the release number as reported by the show version command to the major releases in the first column below. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that their current hardware and software configurations will continue to be supported properly by the new release.