CVE-2020-3218

CVE-2020-3218 describes a Cisco IOS XE Software Web UI remote code execution vulnerability caused by improper validation of user input. An authenticated admin can create a malicious file on the device and upload another to execute arbitrary code with root privileges on the Linux shell. Affected s...

CVE-2020-3217 Cisco IOS, IOS XE, IOS XR, and NX-OS Software One Platform Kit Remote Code Execution Vulnerability

A vulnerability in the Topology Discovery Service of Cisco One Platform Kit onePK in Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a denial of service DoS condition on...

CVE-2020-3217

The CVE-2020-3217 issue affects Cisco IOS, IOS XE, IOS XR, and NX-OS platforms using the One Platform Kit (onePK) Topology Discovery Service. The root cause is insufficient length restrictions when parsing Cisco Discovery Protocol messages, allowing an unauthenticated adjacent attacker to trigger...

CVE-2020-3216 Cisco IOS XE SD-WAN Software Authentication Bypass Vulnerability

A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for...

CVE-2020-3216 Cisco IOS XE SD-WAN Software Authentication Bypass Vulnerability

A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for...

CVE-2020-3216

CVE-2020-3216 affects Cisco IOS XE SD-WAN Software. Affected component: SD-WAN software with insufficient authentication for certain commands. Root cause: authentication bypass allowing an unauthenticated, physical attacker to stop boot initialization and gain unrestricted root-shell access. Impa...

CVE-2020-3215 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the Virtual Services Container of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an affected device. The vulnerability is due to insufficient validation of a user-supplied open virtual appliance OVA. An attacker could exploit...

CVE-2020-3215 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the Virtual Services Container of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an affected device. The vulnerability is due to insufficient validation of a user-supplied open virtual appliance OVA. An attacker could exploit...

CVE-2020-3215

Cisco IOS XE Software Privilege Escalation vulnerability CVE-2020-3215 affects the Virtual Services Container. The issue stems from insufficient validation of a user-supplied Open Virtual Appliance (OVA), allowing an authenticated, local attacker to install a malicious OVA and gain root-level pri...

CVE-2020-3214 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The vulnerability is due to insufficient validation of user-supplied content. This vulnerability could allow an attacker to load malicious...

CVE-2020-3214

CVE-2020-3214 is a Cisco IOS XE Privilege Escalation vulnerability. An authenticated, local attacker can escalate to root-level privileges due to insufficient validation of user-supplied content, enabling loading of malicious software on affected devices. Affected software is Cisco IOS XE; the ro...

CVE-2020-3214 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The vulnerability is due to insufficient validation of user-supplied content. This vulnerability could allow an attacker to load malicious...

CVE-2020-3213 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot...

CVE-2020-3213 Cisco IOS XE Software Privilege Escalation Vulnerability

A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot...

CVE-2020-3213

CVE-2020-3213 affects Cisco IOS XE Software where the ROMMON allows special parameters to be passed during initial boot, enabling an authenticated, local attacker to escalate from Priv15 to root and execute commands with root privileges. The root cause is a ROMMON parameter handling bypass that p...

CVE-2020-3212 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker could exploit this...

CVE-2020-3212 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker could exploit this...

CVE-2020-3212

CVE-2020-3212 affects Cisco IOS XE Software Web UI. Affected component: Web UI; vulnerability type: command injection via uploaded crafted files due to improper input sanitization. Impact: authenticated remote attacker could inject and execute arbitrary commands with root privileges on the device...

CVE-2020-3211 Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker who has valid...

CVE-2020-3211

CVE-2020-3211 concerns Cisco IOS XE Software Web UI Command Injection. The connected Cisco advisory confirms an authenticated, remote attacker could exploit improper input sanitization in the Web UI to run arbitrary commands with root privileges on the device’s operating system. The impact is con...