Cisco IOS XR Software netconf DoS (cisco-sa-20180502-iosxr)

According to its self-reported version, Cisco IOS XR Software is affected by a denial of service DoS vulnerability in the netconf interface due to improper handling of malformed requests. An unauthenticated, remote attacker can exploit this, by sending malicious requests to the affected software,...

CVE-2019-16022

Multiple vulnerabilities in the implementation of Border Gateway Protocol BGP Ethernet VPN EVPN functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerabilities are due to incorrect processing of BGP update...

CVE-2019-16020

Multiple vulnerabilities in the implementation of Border Gateway Protocol BGP Ethernet VPN EVPN functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerabilities are due to incorrect processing of BGP update...

CVE-2019-16018

Cisco IOS XR Software EVPN BGP operational routes vulnerability (CVE-2019-16018) allows unauthenticated remote DoS through crafted BGP EVPN update messages that trigger BGP process restart. Affected component: BGP EVPN handling in IOS XR; impact is DoS (availability) with no confidentiality/integ...

CVE-2019-16020: Uncontrolled Resource Consumption

Multiple vulnerabilities in the implementation of Border Gateway Protocol BGP Ethernet VPN EVPN functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerabilities are due to incorrect processing of BGP update...

CVE-2019-15989: Improper Check for Unusual or Exceptional Conditions

A vulnerability in the implementation of the Border Gateway Protocol BGP functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to incorrect processing of a BGP update message that contains a...

CVE-2019-16027: Improper Input Validation

A vulnerability in the implementation of the Intermediate System–to–Intermediate System IS–IS routing protocol functionality in Cisco IOS XR Software could allow an authenticated, remote attacker to cause a denial of service DoS condition in the IS–IS process. The vulnerability is due to improper...

CVE-2019-15998

A vulnerability in the access-control logic of the NETCONF over Secure Shell SSH of Cisco IOS XR Software may allow connections despite an access control list ACL that is configured to deny access to the NETCONF over SSH of an affected device. The vulnerability is due to a missing check in the...

CVE-2019-15998 Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass Vulnerability

A vulnerability in the access-control logic of the NETCONF over Secure Shell SSH of Cisco IOS XR Software may allow connections despite an access control list ACL that is configured to deny access to the NETCONF over SSH of an affected device. The vulnerability is due to a missing check in the...

CVE-2019-15998

Cisco IOS XR Software NETCONF over SSH ACL bypass (CVE-2019-15998) arises from a missing check in the NETCONF over SSH ACL. Affected versions include Cisco IOS XR 6.5.1 and 6.5.2. The vulnerability could allow an attacker with valid credentials to connect to the NETCONF port despite an ACL that d...

CVE-2019-15998: Improper Access Control

A vulnerability in the access-control logic of the NETCONF over Secure Shell SSH of Cisco IOS XR Software may allow connections despite an access control list ACL that is configured to deny access to the NETCONF over SSH of an affected device. The vulnerability is due to a missing check in the...

Cisco IOS XR Software CVE-2019-15998 Security Bypass Vulnerability

Description Cisco IOS XR Software is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the access control list and perform unauthorized actions. This issue is being tracked by Cisco Bug ID CSCvp91299. Technologies Affected Cisco IOS XR Software 6.5.1 Cisco IOS...

Input validation

A vulnerability in a CLI command related to the virtualization manager VMAN in Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. The...

CVE-2019-12709 Cisco IOS XR Software for Cisco ASR 9000 VMAN CLI Privilege Escalation Vulnerability

A vulnerability in a CLI command related to the virtualization manager VMAN in Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. The...

CVE-2019-12709

CVE-2019-12709 describes a privilege-escalation vulnerability in Cisco IOS XR Software for Cisco ASR 9000 Series (VMAN CLI). An authenticated, local attacker can exploit insufficient validation of VMAN CLI arguments to execute arbitrary commands on the underlying Linux OS with root privileges, po...

CVE-2019-12709: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in a CLI command related to the virtualization manager VMAN in Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. The...

Cisco Releases Security Updates for Multiple Products

Cisco has released security updates to address vulnerabilities in multiple Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the...

CVE-2019-1910

A vulnerability in the implementation of the Intermediate SystemtoIntermediate System ISIS routing protocol functionality in Cisco IOS XR Software could allow an unauthenticated attacker who is in the same ISIS area to cause a denial of service DoS condition. The vulnerability is due to incorrect...

CVE-2019-1910

Cisco IOS XR Software prior to Release 6.6.3 is vulnerable to an IS-IS Denial of Service through crafted IS-IS link-state PDUs. The issue stems from incorrect processing of these PDUs, allowing an unauthenticated attacker in the same IS-IS area to trigger a restart of the IS-IS process and a DoS ...

CVE-2019-1910: Improper Input Validation

A vulnerability in the implementation of the Intermediate System–to–Intermediate System IS–IS routing protocol functionality in Cisco IOS XR Software could allow an unauthenticated attacker who is in the same IS–IS area to cause a denial of service DoS condition. The vulnerability is due to...