CVE-2020-3213 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot...

CVE-2020-3211

CVE-2020-3211 concerns Cisco IOS XE Software Web UI Command Injection. The connected Cisco advisory confirms an authenticated, remote attacker could exploit improper input sanitization in the Web UI to run arbitrary commands with root privileges on the device’s operating system. The impact is con...

CVE-2020-3209 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

CVE-2020-3204

CVE-2020-3204 affects Cisco IOS and IOS XE Tcl interpreter. The vulnerability arises from insufficient input validation of data passed to Tcl, allowing an authenticated, local attacker with privileged EXEC credentials to execute arbitrary code on the underlying OS with root privileges. Impact is ...

CVE-2020-3201

CVE-2020-3201 describes a DoS in Cisco IOS and IOS XE caused by insufficient input validation in the Tcl interpreter. An authenticated, local attacker with privileged EXEC credentials can trigger crafted Tcl arguments to cause the device to reload. Relevant details come from Cisco advisories and ...

Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability that could result in the loading of unsigned firmware on boot. An authenticated attacker could exploit this flaw to load malicious firmware onto the device. cisco-sa-20190925-iosxe-digsig-bypass TRUSTED...

Cisco IOS XE Software Forwarding Information Base DoS (cisco-sa-20180328-FIB-dos)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Forwarding Information Base code due to a limitation in the way the FIB is internally representing recursive routes. An unauthenticated, network attacker can exploit this, by...

Cisco IOS XE Software Zone-Based Firewall IP Fragmentation DoS (cisco-sa-20180328-fwip)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the Zone-Based Firewall due to the way fragmented packets in the firewall code. An unauthenticated, remote attacker can exploit this by sending fragmented IP Version 4 or IP Version 6 packets through a...

Cisco IOS XE Software Filesystem Exhaustion Denial of Service Vulnerability

A vulnerability in the filesystem resource management code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to exhaust filesystem resources on an affected device and cause a denial of service DoS condition. The vulnerability is due to ineffective management of the underlyi...

Cisco IOS XE Software IOx Guest Shell Namespace Protection Vulnerability (cisco-sa-20190925-iox-gs)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the filesystem which allows an authenticated, local attacker within the IOx Guest Shell to modify the namespace container protections on an affected device. The vulnerability is due to insufficient fil...

Cisco IOS XE Software HTTP Client Information Disclosure Vulnerability (cisco-sa-20190925-http-client)

According to its self-reported version, IOS XE Software is affected by a vulnerability in the HTTP client feature that allows an unauthenticated, remote attacker to read and modify data that should normally be sent via an encrypted channel. This vulnerability is due to TCP port information not...

Cisco IOS XE Software TrustSec Protected Access Credential Provisioning DoS (cisco-sa-20190925-ctspac-dos)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service vulnerability. This is due to improper validation of attributes in RADIUS messages. An attacker can exploit this vulnerability by a sending malicious RADIUS message whil ethe device is in a specific...

Cisco IOS XE Software HTTP Server DoS (cisco-sa-20190925-httpserv-dos)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the HTTP server code. This is due to a logical error in the HTTP server logging mechanism. An unauthenticated, remote attacker can exploit this by generating a large amount of long-lived connections to...

Cisco IOS XE Software ASIC Register Write Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. The vulnerability allows an authenticated, local attacker to write values to the underlying memory of an affected device. The vulnerability is due to improper input validation and authorization of specif...

Cisco IOS XE Software Unified Threat Defense Denial of Service Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information TRUSTED...

CVE-2019-12659

A vulnerability in the HTTP server code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the HTTP server to crash. The vulnerability is due to a logical error in the logging mechanism. An attacker could exploit this vulnerability by generating a high amount of...

CVE-2019-12666

A vulnerability in the Guest Shell of Cisco IOS XE Software could allow an authenticated, local attacker to perform directory traversal on the base Linux operating system of Cisco IOS XE Software. The vulnerability is due to incomplete validation of certain commands. An attacker could exploit thi...

CVE-2019-12669

A vulnerability in the RADIUS Change of Authorization CoA code of Cisco TrustSec, a feature within Cisco IOS XE Software, could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of a malformed...

CVE-2019-12663

A vulnerability in the Cisco TrustSec CTS Protected Access Credential PAC provisioning module of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to improper...

CVE-2019-12661

A vulnerability in a Virtualization Manager VMAN related CLI command of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root. The vulnerability is due to insufficient validation of...