CVE-2017-6615

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a race condition that could occur when the affected software processes an SNMP read...

CVE-2017-3861

Cisco IOS and IOS XE EnergyWise DoS vulnerabilities (CVE-2017-3861, among others) stem from improper parsing of crafted EnergyWise IPv4 packets. An unauthenticated remote attacker can trigger a buffer overflow or device reload, causing denial of service. IPv6 is not exploitable; only devices conf...

CVE-2017-3861

Multiple vulnerabilities in the EnergyWise module of Cisco IOS 12.2 and 15.0 through 15.6 and Cisco IOS XE 3.2 through 3.18 could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service DoS condition. These...

Cisco IOS XE Software Simple Network Management Protocol Subsystem Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources...

Cisco IOS Software EnergyWise Denial of Service Vulnerabilities (cisco-sa-20170419-energywise)

Multiple vulnerabilities in the EnergyWise module of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service DoS condition. SPDX-FileCopyrightText: 2017 Greenbone AG Some text...

Design/Logic Flaw

A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known...

Memory corruption

A vulnerability in Google-defined remote procedure call gRPC handling in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon emsd to crash due to a system memory leak, resulting in a denial of service DoS condition. This vulnerability...

CVE-2017-6599

A vulnerability in Google-defined remote procedure call gRPC handling in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon emsd to crash due to a system memory leak, resulting in a denial of service DoS condition. This vulnerability...

CVE-2017-6606

A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known...

Cisco IOS XR Denial of Service Vulnerability (CNVD-2017-05132)

Cisco IOS is the interconnected Internet operating system used on most Cisco Systems routers and network switches. A denial of service vulnerability exists in Cisco IOS XR, which can be exploited by a remote attacker to cause a denial of service process reloading by exploiting a memory leak...

Cisco IOS Smart Install Protocol Misuse (cisco-sr-20170214-smi)

The remote Cisco IOS device has the Smart Install feature enabled. The Smart Install SMI protocol does not require authentication by design. The absence of an authorization or authentication mechanism in the SMI protocol between the integrated branch clients IBC and the director can allow a clien...

Cisco IOS XE Smart Install Protocol Misuse (cisco-sr-20170214-smi)

The remote Cisco IOS XE device has the Smart Install Feature enabled. The Smart Install SMI protocol does not require authentication by design. The absence of an authorization or authentication mechanism in the SMI protocol between the integrated branch clients IBC and the director can allow a...

Cisco IOS XE Web User Interface DoS (cisco-sa-20170322-webui)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the web user interface due to insufficient resource handling. An unauthenticated, remote attacker can exploit this issue, by sending a high number of...

Cisco IOS XE HTTP Parameters Command Injection (cisco-sa-20170322-xeci)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by an command injection vulnerability due to insufficient validation of user-supplied HTTP input parameters. An authenticated, remote attacker can exploit this issue, via a specially crafted...

Cisco IOS DHCP Client DoS (cisco-sa-20170322-dhcpc)

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the DHCP client implementation when parsing DHCP packets. An unauthenticated, remote attacker can exploit this issue, via specially crafted DHCP packets,...

Cisco IOS XE DHCP Client DoS (cisco-sa-20170322-dhcpc)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the DHCP client implementation when parsing DHCP packets. An unauthenticated, remote attacker can exploit this issue, via specially crafted DHCP...

Cisco IOS L2TP Parsing DoS (cisco-sa-20170322-l2tp)

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in its Layer 2 Tunneling Protocol L2TP parsing function due to insufficient validation of L2TP packets. An unauthenticated, remote attacker can exploit this...

Cisco IOS XE L2TP Parsing DoS (cisco-sa-20170322-l2tp)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in its Layer 2 Tunneling Protocol L2TP parsing function due to insufficient validation of L2TP packets. An unauthenticated, remote attacker can exploit...

Cisco IOS XE Cluster Management Protocol Telnet Option Handling RCE (cisco-sa-20170317-cmp)

According to its self-reported version and configuration, the Cisco IOS XE software running on the remote device is affected by a remote code execution vulnerability in the Cluster Management Protocol CMP subsystem due to improper handling of CMP-specific Telnet options. An unauthenticated, remot...

Cisco IOS Cluster Management Protocol Telnet Option Handling RCE (cisco-sa-20170317-cmp)

According to its self-reported version and configuration, the Cisco IOS software running on the remote device is affected by a remote code execution vulnerability in the Cluster Management Protocol CMP subsystem due to improper handling of CMP-specific Telnet options. An unauthenticated, remote...