CVE-2017-6606

Cisco IOS XE Software startup script local command execution vulnerability (CVE-2017-6606) allows an unauthenticated attacker with physical access to a targeted device to run arbitrary commands with root privileges. Root cause: insufficient validation of ROMMON variables in the startup script, en...

Cisco IOS XE Software Startup Script Local Command Execution Vulnerability

A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. SPDX-FileCopyrightText: 2017 Greenbone AG Some te...

Cisco IOS XE Smart Install Protocol Misuse (cisco-sr-20170214-smi)

The remote Cisco IOS XE device has the Smart Install Feature enabled. The Smart Install SMI protocol does not require authentication by design. The absence of an authorization or authentication mechanism in the SMI protocol between the integrated branch clients IBC and the director can allow a...

Cisco IOS XE Software Startup Script Local Command Execution Vulnerability

A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. The vulnerability is due to insufficient validati...

Cisco IOS XE HTTP Parameters Command Injection (cisco-sa-20170322-xeci)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by an command injection vulnerability due to insufficient validation of user-supplied HTTP input parameters. An authenticated, remote attacker can exploit this issue, via a specially crafted...

Cisco IOS XE Web User Interface DoS (cisco-sa-20170322-webui)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the web user interface due to insufficient resource handling. An unauthenticated, remote attacker can exploit this issue, by sending a high number of...

Cisco IOS XE L2TP Parsing DoS (cisco-sa-20170322-l2tp)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in its Layer 2 Tunneling Protocol L2TP parsing function due to insufficient validation of L2TP packets. An unauthenticated, remote attacker can exploit...

Cisco IOS XE DHCP Client DoS (cisco-sa-20170322-dhcpc)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the DHCP client implementation when parsing DHCP packets. An unauthenticated, remote attacker can exploit this issue, via specially crafted DHCP...

Cisco IOS XE Cluster Management Protocol Telnet Option Handling RCE (cisco-sa-20170317-cmp)

According to its self-reported version and configuration, the Cisco IOS XE software running on the remote device is affected by a remote code execution vulnerability in the Cluster Management Protocol CMP subsystem due to improper handling of CMP-specific Telnet options. An unauthenticated, remot...

Assigning a GPU to a Windows VM using xe CLI

To assign a GPU to a Windows VM using xe CLI...

Cisco IOS XE ANI IPv6 Packets DoS (cisco-sa-20170320-aniipv6)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the Autonomic Networking Infrastructure ANI component due to incomplete input validation of certain crafted IPv6 packets. An unauthenticated, remote...

Cisco IOS XE ANI Registrar DoS (cisco-sa-20170320-ani)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the Autonomic Networking Infrastructure ANI registrar feature due to incomplete input validation of certain crafted packets. An unauthenticated,...

Cisco Patches Critical IOx Vulnerability

Cisco Systems patched a critical vulnerability Wednesday that could allow an unauthenticated, remote attacker to execute remote code on affected hardware and gain root privileges. The bug is in Cisco’s Data-in-Motion DMo process, part of the company’s IOx application environment that marries its...

Cisco IOS XE Arbitrary Command Execution Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. An arbitrary command execution vulnerability exists in the Web framework of Cisco IOS XE Software, which allows an authenticated, remote attacker to inject arbitrary commands with root privileges due to...

Cisco IOS Software DHCP Client Denial of Service Vulnerability (cisco-sa-20170322-dhcpc)

A vulnerability in the DHCP client implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

Cisco IOS XE Software Web User Interface Denial of Service Vulnerability

A vulnerability in the web user interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Cisco IOS XE Software Layer 2 Tunneling Protocol Denial of Service Vulnerability

A vulnerability in the Layer 2 Tunneling Protocol L2TP parsing function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, an...

Cisco IOS XE Software DHCP Client Denial of Service Vulnerability

A vulnerability in the DHCP client implementation of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C...

Cisco IOS XE Software HTTP Command Injection Vulnerability

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

CVE-2017-3857

A vulnerability in the Layer 2 Tunneling Protocol L2TP parsing function of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and Cisco IOS XE 3.1 through 3.18 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient validation...