CVE-2017-12236: Improper Authentication

A vulnerability in the implementation of the Locator/ID Separation Protocol LISP in Cisco IOS XE 3.2 through 16.5 could allow an unauthenticated, remote attacker using an x tunnel router to bypass authentication checks performed when registering an Endpoint Identifier EID to a Routing Locator RLO...

CVE-2017-12229

A vulnerability in the REST API of the web-based user interface web UI of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to bypass authentication to the REST API of the web UI of the affected software. The vulnerability is due to insufficient input validation for th...

CVE-2017-12237

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of servi...

CVE-2017-12222

CVE-2017-12222 describes a DoS in Cisco IOS XE Wireless Controller Manager. An unauthenticated, adjacent attacker can trigger a restart of Cisco Catalyst 3650/3850 switches running IOS XE versions 16.1–16.3.3 by sending a crafted association request, due to insufficient input validation. The vuln...

CVE-2017-12226

CVE-2017-12226 affects Cisco IOS XE on the 5760 WLC, Catalyst 4500E 8-E (Wireless), and NGWC 3850. The root cause is incomplete input validation of HTTP requests in the web GUI when GUI connection state or protocol changes. An authenticated Lobby Administrator could change their GUI connection st...

CVE-2017-12229

The CVE describes an authentication bypass in the REST API of Cisco IOS XE Web UI (versions 3.1–16.5) caused by insufficient input validation. An unauthenticated, remote attacker could bypass REST API authentication and access the web UI if the device has HTTP Server enabled. The issue affects Ci...

CVE-2017-12236

Cisco IOS XE LISP Authentication Bypass (CVE-2017-12236) affects IOS XE 3.2–16.5 when acting as an IPv4/IPv6 map server. A logic regression allows an unauthenticated attacker to bypass EID→RLOC registration checks by sending crafted map-registration requests, potentially injecting invalid EID map...

CVE-2017-12230

Cisco IOS XE Software Web UI Privilege Escalation (CVE-2017-12230) affects Cisco IOS XE 16.2 web UI where incorrect default permissions for newly created users allow an authenticated attacker to elevate privileges by first creating a user via the web UI and then logging in as that user. The Denal...

CVE-2017-12236

A vulnerability in the implementation of the Locator/ID Separation Protocol LISP in Cisco IOS XE 3.2 through 16.5 could allow an unauthenticated, remote attacker using an x tunnel router to bypass authentication checks performed when registering an Endpoint Identifier EID to a Routing Locator RLO...

CVE-2017-12230

A vulnerability in the web-based user interface web UI of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using the web UI of the...

CVE-2017-12222

A vulnerability in the wireless controller manager of Cisco IOS XE could allow an unauthenticated, adjacent attacker to cause a restart of the switch and result in a denial of service DoS condition. The vulnerability is due to insufficient input validation. An attacker could exploit this...

CVE-2017-12237: Undefined Security Weakness

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of servi...

Cisco IOS XE Elevation of Privilege Vulnerability

Cisco IOS XE is an operating system developed by the American company Cisco Cisco for its network equipment. An elevation of privilege vulnerability exists in the web-based user interface of Cisco IOS XE version 16.2, which arises when the program sets incorrect default privileges for new users. ...

CVE-2017-12240: Improper Input Validation

The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system. The attacker could also cause an affected system to reload,...

Cisco IOS and IOS XE Software Denial of Service Vulnerability (CNVD-2017-34218)

Cisco IOS and IOS XE are both operating systems developed by Cisco for its network devices. Cisco IOS Software/Cisco IOS XE Software has a security vulnerability in the IKEv2 module, where an unauthenticated, remote attacker causes CPU exhaustion, traceroute messages, and reloading of affected...

Cisco IOS XE Software Web UI REST API Authentication Bypass Vulnerability

A vulnerability in the REST API of the web-based user interface web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication to the REST API of the web UI of the affected software. The vulnerability is due to insufficient input validation for the REST A...

Cisco IOS XE Software for Cisco 5760 WLC, Cisco Catalyst 4500E Supervisor Engine 8-E, and Cisco NGWC 3850 GUI Privilege Escalation Vulnerability

A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E Wireless Switches, and Cisco New Generation Wireless Controllers NGWC 3850 could allow an authenticated, remote attacker to elevate...

Cisco IOS XE Wireless Controller Manager Denial of Service Vulnerability

A vulnerability in the wireless controller manager of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a restart of the switch and result in a denial of service DoS condition. The vulnerability is due to insufficient input validation. An attacker could exploit this...

Cisco IOS XE Software Web UI Privilege Escalation Vulnerability

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using the web UI of t...

PT-2017-2982

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.1 through 16.5 Description A vulnerability in the REST API of the web-based user interface of Cisco IOS XE could allow an unauthenticated, remote attacker to bypass authentication by sending a malicious API request to a...