Input validation

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker could exploit this...

Design/Logic Flaw

A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot...

Design/Logic Flaw

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass access control restrictions on an affected device. The vulnerability is due to the presence of a proxy service at a specific endpoint of the web UI. An...

Input validation

A vulnerability in the Flexible NetFlow Version 9 packet processor of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper...

CVE-2020-3235

CVE-2020-3235 affects Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500 Series Switches. The root cause is insufficient input validation when processing certain SNMP object identifiers in the SNMP subsystem, enabling an authenticated, remote attacker to trigger a DoS by sending a craf...

CVE-2020-3227 Cisco IOx for IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute Cisco IOx API commands without proper authorization. The vulnerability is due to incorrect handling of requests fo...

CVE-2020-3226

CVE-2020-3226 concerns a vulnerability in the SIP library used by Cisco IOS and IOS XE, where insufficient sanity checks on received SIP messages can allow an unauthenticated, remote attacker to trigger a device reload, causing a DoS. Affected products are Cisco IOS Software and Cisco IOS XE Soft...

CVE-2020-3223

CVE-2020-3223 affects Cisco IOS XE Software Web UI. An authenticated admin could read arbitrary files on the device filesystem due to insufficient file scope limiting. Exploitation involves creating a specific file reference on the filesystem and accessing it via the Web UI. Cisco has released so...

CVE-2020-3222

Cisco IOS XE Software Web UI contains an unauthenticated proxy service at a specific UI endpoint. The vulnerability allows an adjacent, unauthenticated attacker to bypass access controls by proxying requests through the management network, with the proxy reachable via the management VRF. Remediat...

CVE-2020-3215

Cisco IOS XE Software Privilege Escalation vulnerability CVE-2020-3215 affects the Virtual Services Container. The issue stems from insufficient validation of a user-supplied Open Virtual Appliance (OVA), allowing an authenticated, local attacker to install a malicious OVA and gain root-level pri...

CVE-2020-3214

CVE-2020-3214 is a Cisco IOS XE Privilege Escalation vulnerability. An authenticated, local attacker can escalate to root-level privileges due to insufficient validation of user-supplied content, enabling loading of malicious software on affected devices. Affected software is Cisco IOS XE; the ro...

CVE-2020-3213 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot...

CVE-2020-3211

CVE-2020-3211 concerns Cisco IOS XE Software Web UI Command Injection. The connected Cisco advisory confirms an authenticated, remote attacker could exploit improper input sanitization in the Web UI to run arbitrary commands with root privileges on the device’s operating system. The impact is con...

CVE-2020-3209 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

CVE-2020-3204

CVE-2020-3204 affects Cisco IOS and IOS XE Tcl interpreter. The vulnerability arises from insufficient input validation of data passed to Tcl, allowing an authenticated, local attacker with privileged EXEC credentials to execute arbitrary code on the underlying OS with root privileges. Impact is ...

CVE-2020-3201

CVE-2020-3201 describes a DoS in Cisco IOS and IOS XE caused by insufficient input validation in the Tcl interpreter. An authenticated, local attacker with privileged EXEC credentials can trigger crafted Tcl arguments to cause the device to reload. Relevant details come from Cisco advisories and ...

PT-2020-2673

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue is related to insufficient input validation of specific HTTP requests in the web-based user interface of Cisco IOS XE Software. This could allow an authenticated, remo...

PT-2020-2871

Name of the Vulnerable Software and Affected Versions Cisco IOS Software and Cisco IOS XE Software affected versions not specified Description A vulnerability in the Tool Command Language Tcl interpreter could allow an authenticated, local attacker with privileged EXEC credentials to execute...

PT-2020-2676

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root shell access to the underlyin...

PT-2020-2674

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description The issue is related to improper input sanitization in the web UI of Cisco IOS XE Software, allowing an authenticated, remote attacker to execute arbitrary commands with root...