CVE-2020-3465

CVE-2020-3465 affects Cisco IOS XE Software. An unauthenticated, adjacent attacker can trigger a device reload by sending certain valid but atypical Ethernet frames to the Ethernet segment, causing a DoS. The issue stems from incorrect handling of these frames. Cisco provides an advisory and has ...

CVE-2020-3465 Cisco IOS XE Software Ethernet Frame Denial of Service Vulnerability

A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a device to reload. The vulnerability is due to incorrect handling of certain valid, but not typical, Ethernet frames. An attacker could exploit this vulnerability by sending the Ethernet frames on...

CVE-2020-3476

CVE-2020-3476 affects Cisco IOS XE Software. A vulnerability in the CLI implementation of a specific command allows an authenticated, local attacker to overwrite arbitrary files on the underlying host filesystem due to insufficient validation of command parameters. Exploitation requires issuing t...

CVE-2020-3477

CVE-2020-3477 affects Cisco IOS and IOS XE CLI parser. An authenticated, local attacker could obtain read-only access to files on the flash: filesystem due to insufficient command restrictions. Exploitation is local with no user interaction beyond authentication. Cisco’s advisory and related Ness...

CVE-2020-3486

Cisco IOS XE Software for the Catalyst 9000 Family CAPWAP Denial of Service vulnerabilities (CVE-2020-3486 and related CVEs) affect the CAPWAP processing in Catalyst 9800 Series Wireless Controllers. Affected component: CAPWAP packet handling; root cause: insufficient validation of CAPWAP packets...

CVE-2020-3488

CVE-2020-3488 affects Cisco IOS XE Software for Catalyst 9000 Family CAPWAP processing. The vulnerabilities stem from insufficient validation of CAPWAP packets in the CAPWAP handling path, allowing an unauthenticated, adjacent attacker to send malformed CAPWAP frames that can crash and reload the...

CVE-2020-3489

CVE-2020-3489 affects Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers. The issue arises in CAPWAP packet processing where insufficient validation can allow an unauthenticated, adjacent attacker to send malformed CAPWAP packets, potentially crashing and reloading the device and...

CVE-2020-3494

Cisco CVE-2020-3494 affects Cisco IOS XE Software for the Catalyst 9800 Series Wireless Controllers and relates to multiple CAPWAP processing vulnerabilities caused by insufficient validation of CAPWAP packets. An unauthenticated, adjacent attacker can send malformed CAPWAP packets to trigger a c...

CVE-2020-3503

Summary of CVE-2020-3503 (Cisco IOS XE Guest Shell Unauthorized File System Access) Cisco IOS XE Software contains a vulnerability in the file system permissions of the guest shell. The issue stems from insufficient file system permissions, allowing an authenticated, local attacker to access or m...

CVE-2020-3509 Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers DHCP Denial of Service Vulnerability

A vulnerability in the DHCP message handler of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause the supervisor to crash, which could result in a denial of service DoS condition. The vulnerability is due to insufficient erro...

CVE-2020-3510

CVE-2020-3510 affects Cisco IOS XE Umbrella Connector on Catalyst 9200 Series switches. Root cause: insufficient error handling when parsing DNS requests. An unauthenticated remote attacker can send malicious DNS requests to the Umbrella Connector client interface, potentially crashing the iosd p...

CVE-2020-3511

CVE-2020-3511 affects Cisco IOS and IOS XE ISDN Q.931 handling. The issue stems from insufficient input validation in the ISDN Q.931 message processing, which could allow an unauthenticated, adjacent attacker to cause a crash and reload, resulting in DoS. Vulnerable software includes Cisco IOS an...

CVE-2020-3516

CVE-2020-3516 describes an issue in the web server authentication of Cisco IOS XE Software, due to insufficient input validation during authentication. An authenticated, remote attacker could crash the device’s web server by sending unexpected characters during login. The vulnerability affects Ci...

CVE-2020-3526

Cisco IOS XE Software on Cisco cBR-8 Converged Broadband Routers is affected by CVE-2020-3526 in the Common Open Policy Service (COPS) engine. The issue arises from insufficient input validation in the COPS engine, allowing an unauthenticated, remote attacker to crash the device by sending a malf...

Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers DHCP Denial of Service Vulnerability

A vulnerability in the DHCP message handler of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause the supervisor to crash, which could result in a denial of service DoS condition. The vulnerability is due to insufficient erro...

Cisco IOS XE Software Web UI Arbitrary File Read Vulnerability (cisco-sa-webui-filerd-HngnDYGk)

According to its self-reported version, Cisco IOS XE Software is affected by an arbitrary file read vulnerability. Please see the included Cisco BID and Cisco Security Advisory for more information. TRUSTED...

Telnet Vulnerability Affecting Cisco Products: June 2020 (cisco-sa-telnetd-EFJrEzPx)

According to its self-reported version, Cisco IOS XE Software is affected by a Telnet vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

IOS XE Software One Platform Kit Remote Code Execution Vulnerability (cisco-sa-ios-nxos-onepk-rce-6Hhyt4dC)

According to its self-reported version, Cisco IOS XE is affected by a remote code execution vulnerability. Therefore there exists in Cisco One Platform Kit due to a vulnerability in the Topology Discovery Service. An unauthenticated, adjacent attacker can exploit this to bypass authentication and...

Cisco IOS XE Software Privilege Escalation (cisco-sa-priv-esc3-GMgnGCHx)

According to its self-reported version, Cisco IOS XE Software is affected by a privilege escalation vulnerability. A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system...

Cisco IOS XE Software Privilege Escalation (cisco-sa-priv-esc2-A6jVRu7C)

According to its self-reported version, Cisco IOS XE Software is affected by Privilege Escalation vulnerability. An authenticated, local attacker to escalate their privileges to a user with root-level privileges due to insufficient validation of user-supplied content. This vulnerability could all...