Abstract: Vulnerability mining for the Web interface of network devices has become very common,and the abuse of vulnerabilities poses a serious threat,the security and stability of network devices catch the attention in the security field.Fuzzing is the main method for Web interface vulnerability mining of network devices,but these methods have little effect on the Cisco IOS-XE system.Therefore,a static analysis-driven fuzzing framework based on the IOS-XE webUI,called IOXFuzzer,is proposed to detect the underlying command injection vulnerabilities.IOXFuzzer increases the probability of discovering vulnerable code by mo-delling back-end Lua scripts with abstract syntax trees,constructing dangerous path libraries to trace dangerous paths backwards,constructing parameter trees to filter high-quality seed libraries,and generating high-coverage test cases.At the end,IOXFuzzer is evaluated on Cisco ASR 1000,ISR 4000 series physical devices,and CSR 1000v series devices with 69 different firmware versions from 2019 to present and detects a total of eight underlying command injection vulnerabilities,one of which is undisclosed.

Key words: Cisco, IOS-XE, Static analysis, Fuzzing, Command injection