CVE-2021-1451 Cisco IOS XE Software Easy Virtual Switching System Arbitrary Code Execution Vulnerability

A vulnerability in the Easy Virtual Switching System VSS feature of Cisco IOS XE Software for Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying Linux operating system of an...

CVE-2021-1451

The CVE-2021-1451 issue affects Cisco IOS XE Software Easy Virtual Switching System (VSS) on Cisco Catalyst 4500/4500-X switches. The root cause is improper boundary checks in Easy VSS protocol packets, allowing an unauthenticated, remote attacker to send crafted packets to UDP port 5500 while th...

CVE-2021-1451 Cisco IOS XE Software Easy Virtual Switching System Arbitrary Code Execution Vulnerability

A vulnerability in the Easy Virtual Switching System VSS feature of Cisco IOS XE Software for Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying Linux operating system of an...

CVE-2021-1446

CVE-2021-1446 describes a denial-of-service vulnerability in the DNS Application Layer Gateway (ALG) functionality used by NAT in Cisco IOS XE software. The issue arises from a logic error when the device inspects certain DNS packets; an unauthenticated, remote attacker can exploit this by sendin...

CVE-2021-1446 Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability

A vulnerability in the DNS application layer gateway ALG functionality used by Network Address Translation NAT in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a logic error that occurs when an affected...

CVE-2021-1443

Cisco IOS XE Software Web UI OS Command Injection (CVE-2021-1443) is a web UI vulnerability in which an authenticated attacker with privileged credentials can tamper with a configuration file and, via an API call, inject and execute arbitrary code with root privileges on the device. Root cause: i...

CVE-2021-1441

Summary of CVE-2021-1441 (Cisco IOS XE hardware initialization ARBITRARY CODE EXECUTION) Affected products: Cisco IOS XE Software on Cisco 1100 Series Industrial Integrated Services Routers and Cisco ESR6300 Embedded Series Routers. Root cause: Incorrect validation of parameters passed to a diagn...

CVE-2021-1441 Cisco IOS XE Software Hardware Initialization Routines Arbitrary Code Execution Vulnerability

A vulnerability in the hardware initialization routines of Cisco IOS XE Software for Cisco 1100 Series Industrial Integrated Services Routers and Cisco ESR6300 Embedded Series Routers could allow an authenticated, local attacker to execute unsigned code at system boot time. This vulnerability is...

CVE-2021-1442

CVE-2021-1442 describes a privilege-escalation in Cisco IOS XE’s Plug-and-Play (PnP) subsystem. An authenticated, local attacker can exploit the diagnostic CLI (show pnp profile) on a device with a specific PnP listener enabled to obtain a privileged authentication token and execute privileged co...

CVE-2021-1442 Cisco IOS XE Software Plug-and-Play Privilege Escalation Vulnerability

A vulnerability in a diagnostic command for the Plug-and-Play PnP subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to the level of an Administrator user level 15 on an affected device. The vulnerability is due to insufficient protection of...

CVE-2021-1442 Cisco IOS XE Software Plug-and-Play Privilege Escalation Vulnerability

A vulnerability in a diagnostic command for the Plug-and-Play PnP subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to the level of an Administrator user level 15 on an affected device. The vulnerability is due to insufficient protection of...

CVE-2021-1436

CVE-2021-1436 describes a vulnerability in the CLI of Cisco IOS XE SD-WAN Software where insufficient validation of user-supplied input enables a locally authenticated attacker to perform path traversal and read arbitrary files on the device. The issue is rooted in input validation weakness in th...

CVE-2021-1436 Cisco IOS XE SD-WAN Software Path Traversal Vulnerability

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could...

CVE-2021-1436 Cisco IOS XE SD-WAN Software Path Traversal Vulnerability

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could...

CVE-2021-1435 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted...

CVE-2021-1435 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted...

CVE-2021-1435

CVE-2021-1435 affects Cisco IOS XE Software Web UI, allowing an authenticated attacker to inject and execute arbitrary commands as root due to insufficient input validation. Exploitation occurs via crafted requests to the Web UI; impact is root-level command execution. Cisco released advisories a...

CVE-2021-1434 Cisco IOS XE SD-WAN Software Arbitrary File Corruption Vulnerability

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system. This vulnerability is due to insufficient validation of the parameters of a specific CLI command. An attacker could exploit this...

CVE-2021-1434 Cisco IOS XE SD-WAN Software Arbitrary File Corruption Vulnerability

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system. This vulnerability is due to insufficient validation of the parameters of a specific CLI command. An attacker could exploit this...

CVE-2021-1434

CVE-2021-1434 affects Cisco IOS XE SD-WAN Software. The CLI contains insufficient validation of parameters for a specific command, enabling an authenticated, local attacker to overwrite arbitrary files on the underlying host file system. Exploitation requires issuing the crafted CLI command with ...