CVE-2018-0466 Cisco IOS and IOS XE Software OSPFv3 Denial of Service Vulnerability

A vulnerability in the Open Shortest Path First version 3 OSPFv3 implementation in Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload. The vulnerability is due to incorrect handling of specific OSPFv3 packets. An attacker could...

CVE-2018-15374 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install a malicious software image or file on an affected device. The vulnerability is due to the affected software improperly verifying digital signatures for software image...

CVE-2018-0197

Cisco IOS and IOS XE Software VLAN Trunking Protocol (VTP) Denial of Service vulnerability (CVE-2018-0197) allows an unauthenticated adjacent attacker to corrupt the VTP database and cause DoS. Root cause is a logic error in handling a subset of VTP packets; exploiting a packet sequence triggers ...

CVE-2018-0477

The CVE-2018-0477 entry describes a local, command-injection vulnerability in the CLI parser of Cisco IOS XE Software. An authenticated attacker with Privilege Level 15 can exploit improper sanitization of CLI command arguments to access internal data structures and execute arbitrary root command...

CVE-2018-0477 Cisco IOS XE Software Command Injection Vulnerabilities

A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exist because the affected software improperly sanitizes command arguments, faili...

CVE-2018-0476

CVE-2018-0476 describes a DoS in Cisco IOS XE NAT SIP ALG. An unauthenticated, remote attacker could send crafted SIP packets to UDP port 5060 while NAT is performed for SIP, triggering improper processing and causing the device to reload. The consequence is a denial of service with availability ...

CVE-2018-0476 Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability

A vulnerability in the Network Address Translation NAT Session Initiation Protocol SIP Application Layer Gateway ALG of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of SIP packets in...

CVE-2018-0470 Cisco IOS XE Software HTTP Denial of Service Vulnerability

A vulnerability in the web framework of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition on an affected device, resulting in a denial of service DoS condition. The vulnerability is due to the affected software improperly parsing malformed...

CVE-2018-0481

The CVE-2018-0481 issue is a vulnerability in the Cisco IOS XE Software CLI parser that allows a locally authenticated attacker with privileged EXEC access to inject and run arbitrary commands as root on the device’s Linux shell. Root cause: improper sanitization of CLI command arguments, allowin...

CVE-2018-0471

CVE-2018-0471 affects Cisco IOS XE CDP: Releases 16.6.1 and 16.6.2 permit an unauthenticated, adjacent attacker to cause memory leaks by processing certain CDP packets, potentially exhausting memory and triggering a crash with reload. The underlying issue is incorrect handling of specific CDP pac...

CVE-2018-0480

CVE-2018-0480 affects Cisco IOS XE Software, specifically the errdisable per VLAN feature. The vulnerability arises from a race condition when the VLAN and port enter an errdisabled state, leading to an incorrect software state and potential device crash (DoS). Exploitation would involve sending ...

CVE-2018-15377

Cisco IOS and IOS XE Software Plug and Play (Open Plug-n-Play) agent has a memory-leak vulnerability caused by insufficient input validation. An unauthenticated, remote attacker can send invalid data to the Plug and Play agent, potentially causing a memory leak and device reload. Affected: Cisco ...

CVE-2018-0469 Cisco IOS XE Software Web UI Denial of Service Vulnerability

A vulnerability in the web user interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a double-free-in-memory handling by the affected software when specific HTTP requests are processed. An attacker...

CVE-2018-0470 Cisco IOS XE Software HTTP Denial of Service Vulnerability

A vulnerability in the web framework of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition on an affected device, resulting in a denial of service DoS condition. The vulnerability is due to the affected software improperly parsing malformed...

CVE-2018-0470

CVE-2018-0470 affects Cisco IOS XE Software web framework. An unauthenticated, remote attacker can trigger a buffer overflow by sending a malformed HTTP packet, causing denial of service. The vulnerability stems from improper parsing of HTTP requests destined to a device. Affected product familie...

CVE-2018-0469

Cisco IOS XE Software Web UI Denial of Service vulnerability (CVE-2018-0469) arises from a double-free in memory handling when processing specific HTTP requests in the web UI, allowing an unauthenticated remote attacker with access to the management interface to remotely trigger a device reload (...

CVE-2018-15377 Cisco IOS and IOS XE Software Plug and Play Agent Memory Leak Vulnerability

A vulnerability in the Cisco Network Plug and Play agent, also referred to as the Cisco Open Plug-n-Play agent, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The vulnerability is due to insufficient...

CVE-2018-15371 Cisco IOS XE Software Shell Access Authentication Bypass Vulnerability

A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient...

CVE-2018-0475

CVE-2018-0475 affects Cisco IOS and IOS XE Cluster Management Protocol (CMP) handling. The flaw stems from improper input validation of CMP messages, enabling an unauthenticated, adjacent attacker to trigger a denial-of-service on affected devices, potentially causing a switch crash and reload or...

CVE-2018-15371

CVE-2018-15371 affects Cisco IOS XE Software, specifically the shell access request mechanism. The issue is an authentication bypass that could let an authenticated, local attacker request access to the root shell and gain unrestricted root access due to insufficient authentication for certain co...