CVE-2021-1391

Cisco IOS/IIS XE Privilege Escalation (CVE-2021-1391) arises from residual dragonite debugger scripts retained on the device, enabling an authenticated, local attacker to bypass the consent token mechanism and escalate from privilege level 15 to root. Affected products include Cisco IOS Software ...

CVE-2021-1391 Cisco IOS and IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the dragonite debugger of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root privilege. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker...

CVE-2021-1391 Cisco IOS and IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the dragonite debugger of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root privilege. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker...

CVE-2021-1392

CVE-2021-1392 : A vulnerability in the CLI command permissions of Cisco IOS and IOS XE Software could let an authenticated, local attacker retrieve the CIP password via the show cip security command and then reconfigure the device as an administrative user. Root cause: incorrect permissions on th...

CVE-2021-1392 Cisco IOS and IOS XE Software Common Industrial Protocol Privilege Escalation Vulnerability

A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol CIP and then remotely configure the device as an administrative user. This vulnerability exists because...

CVE-2021-1394 Cisco IOS XE Software for Network Convergence System 520 Routers Denial of Service Vulnerability

A vulnerability in the ingress traffic manager of Cisco IOS XE Software for Cisco Network Convergence System NCS 520 Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition in the web management interface of an affected device. This vulnerability is due ...

CVE-2021-1394 Cisco IOS XE Software for Network Convergence System 520 Routers Denial of Service Vulnerability

A vulnerability in the ingress traffic manager of Cisco IOS XE Software for Cisco Network Convergence System NCS 520 Routers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition in the web management interface of an affected device. This vulnerability is due ...

CVE-2021-1398 Cisco IOS XE Software Arbitrary Code Execution Vulnerability

A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker with physical access to execute arbitrary code on the underlying Linux operating system of an affected device. This vulnerability is due ...

CVE-2021-1398 Cisco IOS XE Software Arbitrary Code Execution Vulnerability

A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker with physical access to execute arbitrary code on the underlying Linux operating system of an affected device. This vulnerability is due ...

CVE-2021-1398

CVE-2021-1398 affects Cisco IOS XE Software boot logic. The vulnerability stems from improper validation of function arguments passed to the boot script, allowing an authenticated local attacker with level 15 privileges or an attacker with physical access (unauthenticated) to tamper with a file p...

CVE-2021-1403 Cisco IOS XE Software Web UI Cross-Site WebSocket Hijacking Vulnerability

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking CSWSH attack and cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient HTTP protections in...

CVE-2021-1403

CVE-2021-1403 affects Cisco IOS XE Software web UI. The issue arises from insufficient HTTP protections in the web UI, enabling an unauthenticated, remote attacker to perform a cross-site WebSocket hijacking (CSWSH) attack. Exploitation requires a user to click a crafted link, and a successful ex...

CVE-2021-1403 Cisco IOS XE Software Web UI Cross-Site WebSocket Hijacking Vulnerability

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking CSWSH attack and cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient HTTP protections in...

CVE-2021-1454 Cisco IOS XE SD-WAN Software Parameter Injection Vulnerabilities

Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation of certain CLI commands. An attacker could exploit these...

CVE-2021-1454

Cisco IOS XE SD-WAN Software exposes Parameter Injection vulnerabilities in the CLI. An authenticated administrator can submit crafted CLI input to gain root access to the underlying OS on affected devices. Root cause is insufficient input validation of certain CLI commands. Cisco has released so...

CVE-2021-1454 Cisco IOS XE SD-WAN Software Parameter Injection Vulnerabilities

Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation of certain CLI commands. An attacker could exploit these...

CVE-2021-1453

Cisco IOS XE Software for the Catalyst 9000 Family is affected by CVE-2021-1453. The issue is in the image verification function during the initial boot, where an improper check of digital signatures on system image files could allow an unauthenticated, physical attacker to load unsigned software...

CVE-2021-1452 Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability

A vulnerability in the ROM Monitor ROMMON of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches could allow an unauthenticated, physical attacker to execute...

CVE-2021-1452 Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability

A vulnerability in the ROM Monitor ROMMON of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches could allow an unauthenticated, physical attacker to execute...

CVE-2021-1452

CVE-2021-1452 affects Cisco IOS XE ROMMON on Cisco Catalyst IE3200, IE3300, IE3400 Rugged Series Switches, IE3400 Heavy Duty, and Embedded Services 3300 Series. The flaw stems from incorrect validation of function arguments passed to a boot script when specific ROMMON variables are set, allowing ...