Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway DoS (cisco-sa-20190925-sip-alg)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Network Address Translation NAT Session Initiation Protocl SIP Application Layer Gateway ALG. This allows an unauthenticated, remote attacker to cause an affected device to...

Cisco IOS XE Software HTTP Client Information Disclosure Vulnerability (cisco-sa-20190925-http-client)

According to its self-reported version, IOS XE Software is affected by a vulnerability in the HTTP client feature that allows an unauthenticated, remote attacker to read and modify data that should normally be sent via an encrypted channel. This vulnerability is due to TCP port information not...

Cisco IOS XE Software Stored XSS (cisco-sa-20190925-xss)

According to its self-reported version, Cisco IOS XE Software is affected by a stored cross-site scripting XSS vulnerability in its web framework code. This allows an unauthenticated, remote attacker to conduct stored XSS attacks against a user of the web interface of the affected software. The...

Cisco IOS XE Software Raw Socket Transport Denial of Service Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. The vulnerability in the Raw Socket Transport feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service...

Cisco IOS XE Denial of Service Vulnerability (cisco-sa-20190925-sip-dos)

A denial of service DoS vulnerability exists in the Session Initiation Protocol SIP component of Cisco IOS XE due to insufficient checks on an internal data structure which is populated with user submitted data. An unauthenticated, remote attacker can exploit this issue to force a restart of the...

Cisco IOS XE Software TrustSec Protected Access Credential Provisioning DoS (cisco-sa-20190925-ctspac-dos)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service vulnerability. This is due to improper validation of attributes in RADIUS messages. An attacker can exploit this vulnerability by a sending malicious RADIUS message whil ethe device is in a specific...

Cisco IOS XE Software HTTP Server DoS (cisco-sa-20190925-httpserv-dos)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the HTTP server code. This is due to a logical error in the HTTP server logging mechanism. An unauthenticated, remote attacker can exploit this by generating a large amount of long-lived connections to...

Cisco IOS XE Software Consent Token Bypass Vulnerability (cisco-sa-20190925-iosxe-ctbypass)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability it the CLI. The source of the vulnerability is insufficient enforcement of the consent token in authorizing shell access. By authenticating to the CLI and requesting shell access, an attacker could use th...

Cisco IOS XE Software Path Traversal Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the Guest Shell. The vulnerability could allow an authenticated, local attacker to perform directory traversal on the base Linux operating system of Cisco IOS XE Software. The vulnerability is due to...

The vulnerability of the virtualization manager in Cisco IOS XE, allowing a attacker to execute arbitrary commands in the Linux kernel with root privileges.

The vulnerability of the virtualization manager in Cisco IOS XE operating systems relates to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands on the Linux base operating system with root privileges...

The vulnerability of the Cisco TrustSec (CTS) network security management system for the Cisco IOS XE operating system allows a attacker to trigger a service failure.

The vulnerability of the Cisco TrustSec CTS network security management system for the Cisco IOS XE operating system is related to errors during the verification of attributes in RADIUS messages. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

The vulnerability of the Image Verification function in the Cisco IOS XE operating system allows a perpetrator to install malware onto a vulnerable device or upload malicious executable files.

The vulnerability of the Image Verification function in the Cisco IOS XE operating system is related to the lack of verification of file signatures during the system’s loading process. Exploiting this vulnerability allows a perpetrator to install malware onto a vulnerable device or load malicious...

The vulnerability in the implementation of the Identification protocol for Cisco IOS and Cisco IOS XE operating systems allows a perpetrator to trigger a reboot of a vulnerable device.

The vulnerability of the Cisco IOS and Cisco IOS XE operating system identification protocol implementations is related to the assignment of a zero pointer. Exploiting this vulnerability can allow an attacker to remotely trigger a reboot of the vulnerable device...

The vulnerability of a Cisco IOS XE operating system’s file system configuration allows a hacker to execute arbitrary code.

The vulnerability of a Cisco IOS XE operating system’s file system is related to an incorrect definition of the link before accessing a file. Exploiting this vulnerability allows an attacker to execute arbitrary code on the basic operating system with root privileges...

The vulnerability in the configuration of file system permissions in Cisco IOS XE allows a attacker to circumvent container protection and gain access to arbitrary files.

The vulnerability of a network operating system’s file system configuration related to Cisco IOS XE lies in the lack of access control mechanisms. Exploiting this vulnerability can allow an attacker to circumvent container protection and gain access to arbitrary files...

Vulnerability of the HTTP client function in Cisco IOS and Cisco IOS XE operating systems, allowing attackers to read or modify arbitrary data

The vulnerability of the HTTP client function in Cisco IOS and Cisco IOS XE operating systems lies in the fact that information about the TCP port is not considered when comparing new requests with existing persistent HTTP connections. Exploiting this vulnerability allows a remote attacker to rea...

The vulnerability of the Layer 2 Traceroute tool for Cisco IOS XE and Cisco IOS operating systems allows a hacker to create a complete L2 topology of a vulnerable network.

The vulnerability of the Layer 2 Traceroute tool for Cisco IOS XE and Cisco IOS operating systems is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to remotely construct a complete L2 topology of the vulnerable network...

The vulnerability in the Web UI of the Cisco IOS XE operating system, which allows a hacker to execute arbitrary commands with elevated privileges

The vulnerability of the Cisco IOS XE operating system’s Web UI is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with elevated privileges remotely...

The vulnerability lies in the implementation of the SIP protocol and the NAT function of the Application Layer Gateway (ALG) of the Cisco IOS XE operating system. This allows a attacker to trigger a reboot of the vulnerable device.

The vulnerability of the SIP protocol implementation and the NAT function of the Application Layer Gateway ALG on the Cisco IOS XE operating system is related to errors in processing SIP packets. Exploiting this vulnerability allows a malicious actor to trigger a restart of the vulnerable device ...

The vulnerability of the virtualization manager in Cisco IOS XE, allowing a attacker to execute arbitrary commands in the Linux kernel with root privileges.

The vulnerability of the virtualization manager in Cisco IOS XE operating systems exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands on the Linux base...