CVE-2017-6606

A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known...

CVE-2017-6599: Missing Release of Resource after Effective Lifetime

A vulnerability in Google-defined remote procedure call gRPC handling in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon emsd to crash due to a system memory leak, resulting in a denial of service DoS condition. This vulnerability...

CVE-2017-6606: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known...

Cisco IOS XR Denial of Service Vulnerability (CNVD-2017-05132)

Cisco IOS is the interconnected Internet operating system used on most Cisco Systems routers and network switches. A denial of service vulnerability exists in Cisco IOS XR, which can be exploited by a remote attacker to cause a denial of service process reloading by exploiting a memory leak...

Cisco IOS Smart Install Protocol Misuse (cisco-sr-20170214-smi)

The remote Cisco IOS device has the Smart Install feature enabled. The Smart Install SMI protocol does not require authentication by design. The absence of an authorization or authentication mechanism in the SMI protocol between the integrated branch clients IBC and the director can allow a clien...

Cisco IOS XE Smart Install Protocol Misuse (cisco-sr-20170214-smi)

The remote Cisco IOS XE device has the Smart Install Feature enabled. The Smart Install SMI protocol does not require authentication by design. The absence of an authorization or authentication mechanism in the SMI protocol between the integrated branch clients IBC and the director can allow a...

PT-2017-1792

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software versions 6.1.1.BASE through 6.2.1.BASE Description A vulnerability in Google-defined remote procedure call gRPC handling could allow an unauthenticated, remote attacker to cause the Event Management Service daemon emsd to...

PT-2017-1787

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software versions 15.21E through 16.2.0 Cisco IOS XE Software version 15.61.1S Description A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted...

Cisco IOS XE HTTP Parameters Command Injection (cisco-sa-20170322-xeci)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by an command injection vulnerability due to insufficient validation of user-supplied HTTP input parameters. An authenticated, remote attacker can exploit this issue, via a specially crafted...

Cisco IOS XE Web User Interface DoS (cisco-sa-20170322-webui)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the web user interface due to insufficient resource handling. An unauthenticated, remote attacker can exploit this issue, by sending a high number of...

Cisco IOS XE L2TP Parsing DoS (cisco-sa-20170322-l2tp)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in its Layer 2 Tunneling Protocol L2TP parsing function due to insufficient validation of L2TP packets. An unauthenticated, remote attacker can exploit...

Cisco IOS L2TP Parsing DoS (cisco-sa-20170322-l2tp)

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in its Layer 2 Tunneling Protocol L2TP parsing function due to insufficient validation of L2TP packets. An unauthenticated, remote attacker can exploit this...

Cisco IOS DHCP Client DoS (cisco-sa-20170322-dhcpc)

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the DHCP client implementation when parsing DHCP packets. An unauthenticated, remote attacker can exploit this issue, via specially crafted DHCP packets,...

Cisco IOS XE DHCP Client DoS (cisco-sa-20170322-dhcpc)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the DHCP client implementation when parsing DHCP packets. An unauthenticated, remote attacker can exploit this issue, via specially crafted DHCP...

Cisco IOS Cluster Management Protocol Telnet Option Handling RCE (cisco-sa-20170317-cmp)

According to its self-reported version and configuration, the Cisco IOS software running on the remote device is affected by a remote code execution vulnerability in the Cluster Management Protocol CMP subsystem due to improper handling of CMP-specific Telnet options. An unauthenticated, remote...

Cisco IOS XE Cluster Management Protocol Telnet Option Handling RCE (cisco-sa-20170317-cmp)

According to its self-reported version and configuration, the Cisco IOS XE software running on the remote device is affected by a remote code execution vulnerability in the Cluster Management Protocol CMP subsystem due to improper handling of CMP-specific Telnet options. An unauthenticated, remot...

Cisco IOS XE ANI Registrar DoS (cisco-sa-20170320-ani)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the Autonomic Networking Infrastructure ANI registrar feature due to incomplete input validation of certain crafted packets. An unauthenticated,...

Cisco IOS XE ANI IPv6 Packets DoS (cisco-sa-20170320-aniipv6)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the Autonomic Networking Infrastructure ANI component due to incomplete input validation of certain crafted IPv6 packets. An unauthenticated, remote...

Cisco IOS ANI Registrar DoS (cisco-sa-20170320-ani)

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the Autonomic Networking Infrastructure ANI registrar feature due to incomplete input validation of certain crafted packets. An unauthenticated, adjacent...

Cisco IOS XE Arbitrary Command Execution Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. An arbitrary command execution vulnerability exists in the Web framework of Cisco IOS XE Software, which allows an authenticated, remote attacker to inject arbitrary commands with root privileges due to...