Cisco IOS XR Software Model-Driven Programmability Behavior with AAA Authorization

Cisco IOS XR Software supports a programmatic way of configuring and collecting operational data on a network device using data models. Data models provide access to the capabilities of the devices in a network using NETCONF or gRPC. According to Cisco IOS XR Software configuration guides, if...

PT-2023-5460 · Cisco · Cisco Ios Xr

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software affected versions not specified Description: A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system...

Cisco IOS XR Data Forgery Issue Vulnerability

Cisco IOS XR is an operating system developed by Cisco for its network devices. A security vulnerability exists in Cisco IOS XR, which originates from a security hole in the iPXE boot feature that can be exploited by an authenticated attacker to install an unauthenticated software image on an...

Cisco IOS XR Security Vulnerability

Cisco IOS XR is an operating system developed by Cisco for its network devices. A security vulnerability exists in Cisco IOS XR Software, which originates from a security flaw in the Connection Fault Management CFM feature that could be exploited by an unauthenticated attacker to cause a Denial o...

The vulnerability of the Meraki component of the Cisco IOS XR operating system’s microprogramming software for Cisco Catalyst 9200 and Cisco Catalyst 9300 devices allows attackers to increase their privileges.

The vulnerability of the Meraki component of the Cisco IOS XR operating system’s microprogramming software for Cisco Catalyst 9200 and Cisco Catalyst 9300 is caused by buffer overflow in dynamic memory. Exploiting this vulnerability can allow attackers to gain increased privileges...

Fancy Bear known to be exploiting vulnerability in Cisco routers

In a joint advisory, the UK National Cyber Security Centre NCSC, the National Security Agency NSA, the Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI have released information about APT28s exploitation of Cisco routers in 2021. Now please dont st...

CISA Adds One Known Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2017-6742 Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors...

VulnCheck KEV: CVE-2017-6742

The Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload...

The vulnerability of the GRand Unified Bootloader (GRUB) of the Cisco IOS XR router operating system from Network Convergence System’s 540 Series and Cisco 9000 Series routers allows a hacker to execute arbitrary code.

The vulnerability of the GRand Unified Bootloader GRUB in Cisco IOS XR routers from the Network Convergence System 540 Series and Cisco 9000 Series is related to deficiencies in the authentication process. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Cisco IOS XE Software Fragmented Tunnel Protocol Packet DoS (cisco-sa-ios-gre-crash-p6nE5Sq5)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

Vulnerability of the web interface of Cisco IOS XE operating systems, allowing attackers to disclose sensitive information

The vulnerability in the web interface of Cisco IOS XE exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

CVE-2023-20080

A vulnerability in the IPv6 DHCP version 6 DHCPv6 relay and server features of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service DoS condition. This vulnerability is due to insufficient validation of data boundaries. An attacker could...

CVE-2023-20065

A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to insufficient restrictions on the hosted application. An attacker could exploit thi...

CVE-2023-20066

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that are outside the filesystem mountpoint of the web UI. This vulnerability is due to an insufficient security configuration. An attacker cou...

CVE-2023-20067

A vulnerability in the HTTP-based client profiling feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient input validation of...

CVE-2023-20066

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that are outside the filesystem mountpoint of the web UI. This vulnerability is due to an insufficient security configuration. An attacker cou...

CVE-2023-20029

A vulnerability in the Meraki onboarding feature of Cisco IOS XE Software could allow an authenticated, local attacker to gain root level privileges on an affected device. This vulnerability is due to insufficient memory protection in the Meraki onboarding feature of an affected device. An attack...

CVE-2023-20027

A vulnerability in the implementation of the IPv4 Virtual Fragmentation Reassembly VFR feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper reassembly of large packe...

Design/Logic Flaw

A vulnerability in the fragmentation handling code of tunnel protocol packets in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected system to reload, resulting in a denial of service DoS condition. This vulnerability is due to the improper handling of large...

Input validation

A vulnerability in the implementation of the IPv4 Virtual Fragmentation Reassembly VFR feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper reassembly of large packe...