CVE-2020-3199 Cisco IOx Application Environment for IOS Software for Cisco Industrial Routers Vulnerabilities

Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers Industrial ISRs and Cisco 1000 Series Connected Grid Routers CGR1000 that are running Cisco IOS Software could allow an attacker to cause a denial of service DoS condition...

CVE-2020-3230 Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability

A vulnerability in the Internet Key Exchange Version 2 IKEv2 implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2...

CVE-2020-3227 Cisco IOx for IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute Cisco IOx API commands without proper authorization. The vulnerability is due to incorrect handling of requests fo...

CVE-2020-3226

CVE-2020-3226 concerns a vulnerability in the SIP library used by Cisco IOS and IOS XE, where insufficient sanity checks on received SIP messages can allow an unauthenticated, remote attacker to trigger a device reload, causing a DoS. Affected products are Cisco IOS Software and Cisco IOS XE Soft...

CVE-2020-3224 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to an affected device. The injected commands should require a higher privilege level in order to be executed. The...

CVE-2020-3223 Cisco IOS XE Software Web UI Arbitrary File Read Vulnerability

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacke...

CVE-2020-3222

Cisco IOS XE Software Web UI contains an unauthenticated proxy service at a specific UI endpoint. The vulnerability allows an adjacent, unauthenticated attacker to bypass access controls by proxying requests through the management network, with the proxy reachable via the management VRF. Remediat...

CVE-2020-3219 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of user-suppli...

CVE-2020-3215

Cisco IOS XE Software Privilege Escalation vulnerability CVE-2020-3215 affects the Virtual Services Container. The issue stems from insufficient validation of a user-supplied Open Virtual Appliance (OVA), allowing an authenticated, local attacker to install a malicious OVA and gain root-level pri...

CVE-2020-3213 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot...

CVE-2020-3213 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot...

CVE-2020-3209 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

CVE-2020-3207 Cisco IOS XE Software Command Injection Vulnerability

A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root shell access to the underlying operating system OS to conduct a command injection attack during device boot. This vulnerability is due to insufficien...

CVE-2020-3206

CVE-2020-3206 affects Cisco Catalyst 9800 Series Wireless Controllers running IOS XE. The issue is a failure to properly validate IEEE 802.11w Protected Management Frames (PMFs), allowing an unauthenticated, adjacent attacker to terminate a single valid user connection on an affected device. Mult...

CVE-2020-3204 Cisco IOS and IOS XE Software Tcl Arbitrary Code Execution Vulnerability

A vulnerability in the Tool Command Language Tcl interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to execute arbitrary code on the underlying operating system OS with root privileges. The vulnerability is due...

Cisco IOS XE Software Web UI Arbitrary File Read Vulnerability

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacke...

Cisco IOS XE Software Web UI Privilege Escalation Vulnerability

A vulnerability in Role Based Access Control RBAC functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The vulnerability is due to incorrect handling of RBAC for the administrati...

Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of user-suppli...

Cisco IOS Software for Cisco Industrial Routers Virtual Device Server CLI Command Injection Vulnerability

A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers Industrial ISRs and Cisco 1000 Series Connected Grid Routers CGR1000 could allow an authenticated, local attacker to execute arbitrary shell commands on the Virtual Device Server...

Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Static Credentials Vulnerability

A vulnerability in the virtual console authentication of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers Industrial ISRs and Cisco 1000 Series Connected Grid Routers CGR1000 could allow an authenticated but low-privileged, local attacker to log in to the Virtual...