CVE-2017-3864

A vulnerability in the DHCP client implementation of Cisco IOS 12.2, 12.4, and 15.0 through 15.6 and Cisco IOS XE 3.3 through 3.7 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability occurs during the parsing of a crafted DHCP packet. An...

CVE-2017-3857

A vulnerability in the Layer 2 Tunneling Protocol L2TP parsing function of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and Cisco IOS XE 3.1 through 3.18 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient validation...

CVE-2017-3858

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could...

CVE-2017-3856

A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. A...

CVE-2017-3856

A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. A...

CVE-2017-3858

Cisco IOS XE Software HTTP Command Injection (CVE-2017-3858) affects Cisco IOS XE 16.2.1 with HTTP Server enabled. The vulnerability arises from insufficient validation of user-supplied HTTP parameters in the web framework, allowing an authenticated, remote attacker to inject commands that run wi...

CVE-2017-3859

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted...

CVE-2017-3864

CVE-2017-3864 affects Cisco IOS (12.2, 12.4, 15.0–15.6) and Cisco IOS XE (3.3–3.7). The flaw is in the DHCP client parsing code, allowing an unauthenticated, remote attacker to trigger a DoS by sending crafted DHCP packets, potentially causing a device reload. Affects devices configured as DHCP c...

CVE-2017-3857

CVE-2017-3857 is a DoS vulnerability in Cisco IOS (12.0–12.4, 15.0–15.6) and IOS XE (3.1–3.18) caused by improper validation in the Layer 2 Tunneling Protocol (L2TP) parsing function. An unauthenticated, remote attacker can send crafted L2TP packets to trigger a device reload when the L2TP featur...

CVE-2017-3858

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could...

CVE-2017-3856

Cisco IOS XE Web UI Denial of Service (CVE-2017-3856) affects IOS XE releases 3.1–3.17 when the web UI is enabled. The root cause is insufficient resource handling under high HTTP load, allowing an unauthenticated, remote attacker to cause a device reload by flooding the web UI with requests. Imp...

CVE-2017-3864: Undefined Security Weakness

A vulnerability in the DHCP client implementation of Cisco IOS 12.2, 12.4, and 15.0 through 15.6 and Cisco IOS XE 3.3 through 3.7 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability occurs during the parsing of a crafted DHCP packet. An...

PT-2017-2019

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.1 through 3.17 Description A vulnerability in the web user interface of Cisco IOS XE could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resour...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in its IOS, IOS XE, and IOx Software. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system or cause a denial-of-service condition. Users and administrators are encouraged to...

PT-2017-2018

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.0 through 12.4 and 15.0 through 15.6 Cisco IOS XE versions 3.1 through 3.18 Description A vulnerability in the Layer 2 Tunneling Protocol L2TP parsing function exists due to insufficient validation of L2TP packets. This...

CVE-2017-3859: Use of Externally-Controlled Format String

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted...

CVE-2017-3858: Improper Input Validation

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could...

CVE-2017-3857: Uncontrolled Resource Consumption

A vulnerability in the Layer 2 Tunneling Protocol L2TP parsing function of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and Cisco IOS XE 3.1 through 3.18 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient validation...

CVE-2017-3856: Uncontrolled Resource Consumption

A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. A...

PT-2017-2017

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software version 16.2.1 Description A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability...