CVE-2019-1753

CVE-2019-1753: Cisco IOS XE Software Privilege Escalation via the web UI. An authenticated but unprivileged attacker could abuse WSMA input validation to execute privileged IOS commands on the device. Reports indicate Cisco issued updates addressing this vulnerability; apply the published Cisco a...

Cisco IOS and IOS XE Input Validation Vulnerability (CNVD-2019-08718)

Cisco IOS and IOS XE are a set of operating systems developed by Cisco for its network devices. An input validation vulnerability exists in the Network-Based Application Recognition NBAR feature in Cisco IOS and IOS XE, which stems from a parsing problem in the program that could be exploited by ...

Cisco Releases Security Update for Cisco IOS XE

Cisco has released a security update to address a vulnerability in Cisco IOS XE. An attacker could exploit this vulnerability to obtain sensitive information. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the Cisco Security Advisory and...

Cisco IOS XE Catalyst 4500 Denial of Service Vulnerability

Cisco IOS XE is a modular operating system based on the Linux kernel. A denial of service vulnerability exists in the Simple Virtual Switching System VSS of the Cisco IOS XE software on Catalyst 4500 series switches, which stems from a failure to perform a complete processing error when handling...

Cisco IOS XE Information Disclosure Vulnerability

Cisco IOS XE is a modular operating system based on the Linux kernel. An information disclosure vulnerability exists in the web UI of Cisco IOS XE, which can be exploited by a remote attacker to access sensitive configuration information by sending a malicious request to an affected device...

Cisco IOS XE elevation of privilege vulnerability (CNVD-2019-10455)

Cisco IOS XE is a modular operating system based on the Linux kernel. An elevation of privilege vulnerability exists in Cisco IOS XE, which stems from a program that fails to properly validate the privileges of a Web UI user, and can be exploited by a remote attacker to execute arbitrary commands...

Cisco IOS and IOS XE Input Validation Vulnerability (CNVD-2019-08717)

Cisco IOS and IOS XE are a set of operating systems developed by Cisco for its network devices. An input validation vulnerability exists in the Network-Based Application Recognition NBAR feature in Cisco IOS and IOS XE, which stems from a parsing problem in the program that could be exploited by ...

Cisco IOS XE Command Injection Vulnerability (CNVD-2019-10462)

Cisco IOS XE is a modular operating system based on the Linux kernel. A command injection vulnerability exists in the Web Services Management Agent WSMA feature of Cisco IOS XE, which stems from a failure to validate user-supplied input, and can be exploited by a remote authenticated attacker to...

Cisco IOS and IOS XE SMS Denial of Service Vulnerability

Cisco IOS and IOS XE are a set of operating systems developed by Cisco for its network devices. An input validation vulnerability exists in the implementation of the Short Message Service SMS processing feature in Cisco IOS Software version 15.83M and Cisco IOS XE Software version 16.10.1, which...

CVE-2019-1749

Cisco IOS XE Software on ASR 900 Route Switch Processor 3 (RSP3) is affected by an ingress-traffic validation vulnerability in the ASIC path. An unauthenticated, adjacent attacker can trigger a reload of the iosd process by sending a malformed OSPFv2 message, causing a DoS on the device. The issu...

CVE-2019-1750 Cisco IOS XE Software Catalyst 4500 Cisco Discovery Protocol Denial of Service Vulnerability

A vulnerability in the Easy Virtual Switching System VSS of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, adjacent attacker to cause the switches to reload. The vulnerability is due to incomplete error handling when processing Cisco Discovery Protocol CDP...

CVE-2019-1747 Cisco IOS and IOS XE Software Short Message Service Denial of Service Vulnerability

A vulnerability in the implementation of the Short Message Service SMS handling functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected device. The vulnerability is due to improper...

CVE-2019-1746

CVE-2019-1746 affects Cisco IOS and IOS XE where the CMP (Cluster Management Protocol) processing code fails input validation, enabling an unauthenticated, adjacent attacker to trigger a denial-of-service by sending crafted CMP packets. A successful exploit can crash the switch and cause an autom...

CVE-2019-1746 Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability

A vulnerability in the Cluster Management Protocol CMP processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation wh...

CVE-2019-1745 Cisco IOS XE Software Command Injection Vulnerability

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability b...

CVE-2019-1745 Cisco IOS XE Software Command Injection Vulnerability

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability b...

CVE-2019-1745

Cisco IOS XE Software Command Injection Vulnerability (CVE-2019-1745) could allow an authenticated, local attacker to inject arbitrary commands that execute with elevated privileges due to insufficient input validation. Affected systems running Cisco IOS XE may be exploited after authenticating t...

CVE-2019-1742 Cisco IOS XE Software Information Disclosure Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious...

CVE-2019-1742

Cisco IOS XE Software Information Disclosure (CVE-2019-1742) affects the web UI component. An unauthenticated, remote attacker can access sensitive configuration information due to improper access control to web UI files. Exploitation involves sending a crafted request to an affected device. Docu...

CVE-2019-1742 Cisco IOS XE Software Information Disclosure Vulnerability

A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious...