Vulnerabilities found in Cisco Catalyst SD-WAN Controllers and Managers

Cisco has identified vulnerabilities in the Catalyst SD-WAN Controller and Manager products. Cisco has uncovered four vulnerabilities in these products. These vulnerabilities involve XXE injection, privilege escalation, and authentication bypass. The authentication bypass vulnerability resides in...

CVE-2024-20508: Heap-based Buffer Overflow

A vulnerability in Cisco Unified Threat Defense UTD Snort Intrusion Prevention System IPS Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service DoS condition on an affected device. This vulnerability is...

CVE-2015-0654: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System IPS Software before 7.33E4 allows remote attackers to cause a denial of service process hang by establishing many HTTPS sessions, aka Bug ID CSCuq40652...

PT-2015-4771

Name of the Vulnerable Software and Affected Versions Cisco Intrusion Prevention System IPS devices affected versions not specified Description A race condition exists in the SSL implementation, allowing remote attackers to cause a denial of service by making many management-interface HTTPS...

CVE-2014-3406: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the IP logging feature in Cisco Intrusion Prevention System IPS Software 7.17E4 and earlier allows remote attackers to cause a denial of service device reload via crafted IP traffic that matches a problematic rule, aka Bug ID CSCud82085...

PT-2014-4485

Name of the Vulnerable Software and Affected Versions Cisco Intrusion Prevention System IPS Software affected versions not specified Description The issue allows remote attackers to cause a denial of service, resulting in a MainApp process outage, by sending malformed SNMP packets. Recommendation...

CVE-2014-2103: Improper Input Validation

Cisco Intrusion Prevention System IPS Software allows remote attackers to cause a denial of service MainApp process outage via malformed SNMP packets, aka Bug IDs CSCum52355 and CSCul49309...

CVE-2013-5497: Improper Authentication

The authentication manager process in the web framework in Cisco Intrusion Prevention System IPS does not properly handle user tokens, which allows remote attackers to cause a denial of service intermittent MainApp hang via a crafted management-interface connection request, aka Bug ID CSCuf20148...

PT-2013-5581

Name of the Vulnerable Software and Affected Versions Cisco Intrusion Prevention System IPS affected versions not specified Description The issue is related to the authentication manager process in the web framework, which does not properly handle user tokens. This allows remote attackers to caus...

PT-2013-4367

Name of the Vulnerable Software and Affected Versions Cisco Intrusion Prevention System IPS Software on IPS NME devices versions prior to 7.09E4 Description The issue allows remote attackers to cause a denial of service, resulting in a device reload. This is achieved by sending malformed IPv4...

CVE-2013-3410: Improper Restriction of Operations within the Bounds of a Memory Buffer

Cisco Intrusion Prevention System IPS Software on IPS NME devices before 7.09E4 allows remote attackers to cause a denial of service device reload via malformed IPv4 packets that trigger incorrect memory allocation, aka Bug ID CSCua61977...

CVE-2013-3411: Undefined Security Weakness

The IDSM-2 drivers in Cisco Intrusion Prevention System IPS Software on Cisco Catalyst 6500 devices with an IDSM-2 module allow remote attackers to cause a denial of service device hang via malformed IPv4 TCP packets, aka Bug ID CSCuh27460...

CVE-2013-1218: Improper Restriction of Operations within the Bounds of a Memory Buffer

Cisco Intrusion Prevention System IPS Software in ASA 5500-X IPS-SSP software modules before 7.17sp1E4 allows remote attackers to cause a denial of service Analysis Engine process hang or device reload via fragmented 1 IPv4 or 2 IPv6 packets, aka Bug ID CSCue51272...

PT-2013-2982

Name of the Vulnerable Software and Affected Versions Cisco Intrusion Prevention System IPS affected versions not specified Description The issue allows local users to cause a denial of service, resulting in a Regex hardware job failure and application hang. This can be achieved through various...

CVE-2013-1219: Undefined Security Weakness

SensorApp in Cisco Intrusion Prevention System IPS allows local users to cause a denial of service Regex hardware job failure and application hang via a 1 initiate signature upgrade, 2 initiate global correlation, 3 show statistics anomaly-detection, or 4 clear database action, aka Bug ID...

CVE-2011-4022: Improper Authentication

The sensor in Cisco Intrusion Prevention System IPS 7.0 and 7.1 allows remote attackers to cause a denial of service file-handle exhaustion and mainApp hang by making authentication attempts that exceed the configured limit, aka Bug ID CSCto51204...

CVE-2007-2688: Undefined Security Weakness

The Cisco Intrusion Prevention System IPS and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic...