Cisco Small Business 200,300 and 500 Series Switches - Open Redirect

Cisco Small Business 200,300 and 500 Series Switches contain an open redirect vulnerability in the Web UI. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-1943 info: name: Cisco Small...

Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal

A directory traversal vulnerability in Cisco Unified Communications Manager CUCM 5.x and 6.x before 6.15SU2, 7.x before 7.15bSU2, and 8.x before 8.03, and Cisco Unified Contact Center Express aka Unified CCX or UCCX and Cisco Unified IP Interactive Voice Response Unified IP-IVR before 6.01SR1ES8,...

Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File Upload

Cisco ISE and Cisco ISE-PIC contain an unrestricted file upload vulnerability caused by lack of file validation in an internal API, letting unauthenticated remote attackers upload and execute files as root, exploit requires crafted file upload. id: CVE-2025-20282 info: name: Cisco ISE 3.4P2 -...

Cisco IOS XE Web UI - Command Injection

A vulnerability in the web UI component of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to improper input validation in the web UI. An attacker could exploit...

Cisco SD-WAN vManage Software - Local File Inclusion

Cisco SD-WAN vManage Software in the application data endpoints is vulnerable to local file inclusion which could allow an unauthenticated, remote attacker to gain access to sensitive information. id: CVE-2020-26073 info: name: Cisco SD-WAN vManage Software - Local File Inclusion author: madrobot...

Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection

Lantronix PremierWave 2050 8.9.0.0R4 contains an OS command injection vulnerability. A specially-crafted HTTP request can lead to command in the Web Manager Wireless Network Scanner. An attacker can make an authenticated HTTP request to trigger this vulnerability. id: CVE-2021-21881 info: name:...

Cisco RV110W RV130W RV215W Router - Information leakage

A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this...

Cisco Finesse - Server-Side Request Forgery (SSRF)

Cisco Finesse contains an SSRF caused by insufficient validation of user-supplied input in HTTP requests, letting unauthenticated remote attackers access limited sensitive information, exploit requires sending crafted HTTP requests. id: CVE-2024-20404 info: name: Cisco Finesse - Server-Side Reque...

Cisco Secure Firewall Management Center - Authentication Bypass

Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests. id: CVE-2026-20079 info: name: Cisco Secure...

Cisco Unified Communications Manager 7/8/9 - Directory Traversal

A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815 id: CVE-2013-5528 info: name:...

Cisco IOS XE WLC - Arbitrary File Upload

A vulnerability in the Out-of-Band Access Point AP Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web...

TCP-32764

我不会再手动更新此存储库了 如果你想在列表中添加一款路由器，请提交 pull-request，同时记得使用 PoC ，并把结果粘贴到你的 pull-request 中。Telnet 客户端和其他解决方案可能并不适用（已报告存在一些漏报/误报）。 一些关于我在我的 Linksys WAG200G（TCP/32764）中发现的后门的随机代码/数据。 该后门可能也存在于其他硬件中，我会相应地更新此 readme。: 可能的修复方法： 如果它在互联网上监听：在 Web 管理界面中添加一条防火墙规则（@domainzero） 它似乎也可以在局域网侧使用。（issue 35）...

CVE-2018-0114

CVE-2018-0114 Cisco 的 node-jose（一个用于管理 JWT 的 JavaScript 库）中的漏洞利用。 该漏洞存在于 Cisco 的 node-jose 中，允许攻击者伪造恶意令牌。 JWT 允许用户在令牌头部嵌入公钥（使用 jwk 值）。然而，应用程序绝不应信任这些密钥，因为攻击者可以提供自己的密钥，并使用相应的私钥对消息进行签名。 回顾 该问题影响 0.11 之前版本。 如果我们查看修复此问题引入的更改...

snmpvlan

snmpvlan CVE ID: CVE-2014-3341. Cisco Bug ID: CSCup85616. NexusTaco 是一个 SNMP 扫描器，可用于内网测试和外网测试，用于评估 Cisco Nexus 交换机（5000 和 6000 系列）。 市面上已有许多 SNMP 扫描器和暴力破解工具，本工具仅作为补充。它具有以下功能： 专门识别 Nexus 交换机，因为它们似乎会对假 community 字符串进行回应 无需 community 即可暴力破解 VLAN ID，可用于 VLAN 跳跃/双标签攻击（如果第三条不成功，此功能在内部测试中很有用） 暴力破解 SNMP...

CVE-2019-1663

CVE-2019-1663 此存储库的目的是汇总我对CVE-2019-1663漏洞的研究， 该漏洞在Cisco RV110、RV130和RV225路由器的1.0.44.0版本中被发现。...

CVE-2017-3881-Cisco

CVE-2017-3881 Cisco Catalyst RCE 概念実証 2017年4月10日 あなたのCatalystスイッチでtelnetをまだ有効にしていますか？よく考えてください。ここに、最新推奨ファームウェアを搭載したCatalyst 2960スイッチ向けのリモートコード実行の概念実証エクスプロイトがあります。エクスプロイトコードはこちらからご確認ください。以下は、2017年3月7日にCIAのアーカイブから流出し、2017年3月17日にCisco...

staystaystay

staystaystay staystaystay es un exploit de prueba de concepto para CVE-2021-1585, un problema de RCE de intermediario o punto final malicioso que afecta a Cisco ASA Device Manager ASDM. El problema fue descubierto originalmente por Malcolm Lashley y divulgado en el verano de 2021. Sin embargo, en...

CVE-2023-20198-Checker

Cisco-IOS-EX-Scanner CVE-2023-20198 CVE-2023-20198 & 0Day 植入扫描器（已在实验室测试通过，效果因人而异） 这是一个快速且简陋的扫描器，用于检查主机是否受到 Cisco IOS XE 0day 漏洞的影响或已被攻陷。该工具旨在扫描单个目标或目标列表，基于特定检查确定潜在漏洞。 依赖 root@kitploit: pip install requests 使用方法 您可以通过两种模式使用 XE 植入扫描器：单目标模式和多目标模式（使用输入文件）。 单目标模式： root@kitploit: python...

iCULeak.py

iCULeak.py Tool to find and extract credentials from phone configuration files in environments managed by Cisco's CUCM Call Manager. When using Cisco's CUCM Call Manager, phone configuration files are stored on a TFTP server. These VoIP phone configuration files quite frequently contain sensitive...

CVE-2017-6640-POC

CVE-2017-6640-POC Prueba de concepto para CVE-2017-6640 como extensión de Burp Cisco Prime Data Center Network Manager DCNM implementa credenciales estáticas. Ver también: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm2 Más específicamente, la interfa...