PT-2025-32191 · Cisco · Cisco Ise

Name of the Vulnerable Software and Affected Versions: Cisco ISE affected versions not specified Description: A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This issue is...

Cisco ISE和Cisco ISE-PIC 安全漏洞

Cisco ISE and Cisco ISE-PIC are both products of Cisco, Inc.Cisco ISE is a NAC solution. It is used to manage access to network resources by endpoints, users, and devices in a zero-trust architecture.Cisco ISE-PIC is a component ... A security vulnerability exists in Cisco ISE and Cisco ISE-PIC...

Cisco Identity Services Engine (cisco-sa-ise_xss_acc_cont-YsR4uT4U)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of...

The vulnerability of the geteasycfg function (/cgi-bin/lighttpd.cgi) of the Web Management Interface component of the microprogramming-based router LB-LINK BL-AC3600 allows a attacker to disclose protected information.

The vulnerability of the geteasycfg function /cgi-bin/lighttpd.cgi of the Web Management Interface component of the microprogramming-based router LB-LINK BL-AC3600 is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker to disclose sensitiv...

CVE-2025-40599

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution...

CVE-2025-52377

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the...

CVE-2025-20274

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management...

Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack through an affected device. This vulnerability is due to improper input validation for specific HTTP...

CVE-2025-52689

CVE-2025-52689 affects Alcatel-Lucent OmniAccess Stellar Wi‑Fi APs (e.g., Stellar series) via a weak session ID check in the web management interface. The root cause allows an unauthenticated attacker to spoof a login and obtain a valid administrator session ID, potentially letting the attacker m...

CVE-2025-52688 Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface

Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point...

CVE-2025-7565

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possib...

CVE-2025-52377

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the...

CVE-2025-52377

CVE-2025-52377 affects Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and earlier. The vulnerability is in the web management interface’s ping/traceroute endpoints (/web/um_ping_set.cgi) where the Ping_host_text input is not properly sanitized before it reaches the underlying system comma...

CVE-2025-52377

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the...

CVE-2025-7565

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possib...

CVE-2025-7565

LB-LINK BL-AC3600 Web Management Interface (lighttpd.cgi geteasycfg) up to version 1.0.22 is affected. The vulnerability stems from improper handling of the Password argument in /cgi-bin/lighttpd.cgi, enabling information disclosure. Attacks can be initiated remotely and the exploit has been publ...

CVE-2025-7565 LB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosure

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possib...

DrayTek Vigor 1.5.1.4 < 1.5.1.5 Command Injection

The version of DrakTek Vigor installed on the remote host is 1.5.1.4. It is, therefore, affected by a vulnerability, which was classified as critical. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of...

CVE-2025-20307 Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

CVE-2025-20307 Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...