Input validation

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could...

CVE-2017-3856

A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. A...

CVE-2017-3858

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could...

CVE-2017-3857

A vulnerability in the Layer 2 Tunneling Protocol L2TP parsing function of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and Cisco IOS XE 3.1 through 3.18 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient validation...

CVE-2017-3864

A vulnerability in the DHCP client implementation of Cisco IOS 12.2, 12.4, and 15.0 through 15.6 and Cisco IOS XE 3.3 through 3.7 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability occurs during the parsing of a crafted DHCP packet. An...

Design/Logic Flaw

A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. A...

Race condition

A vulnerability in the DHCP client implementation of Cisco IOS 12.2, 12.4, and 15.0 through 15.6 and Cisco IOS XE 3.3 through 3.7 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability occurs during the parsing of a crafted DHCP packet. An...

Format string

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted...

CVE-2017-3856

A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. A...

CVE-2017-3858

Cisco IOS XE Software HTTP Command Injection (CVE-2017-3858) affects Cisco IOS XE 16.2.1 with HTTP Server enabled. The vulnerability arises from insufficient validation of user-supplied HTTP parameters in the web framework, allowing an authenticated, remote attacker to inject commands that run wi...

CVE-2017-3857

CVE-2017-3857 is a DoS vulnerability in Cisco IOS (12.0–12.4, 15.0–15.6) and IOS XE (3.1–3.18) caused by improper validation in the Layer 2 Tunneling Protocol (L2TP) parsing function. An unauthenticated, remote attacker can send crafted L2TP packets to trigger a device reload when the L2TP featur...

CVE-2017-3856

Cisco IOS XE Web UI Denial of Service (CVE-2017-3856) affects IOS XE releases 3.1–3.17 when the web UI is enabled. The root cause is insufficient resource handling under high HTTP load, allowing an unauthenticated, remote attacker to cause a device reload by flooding the web UI with requests. Imp...

CVE-2017-3864

CVE-2017-3864 affects Cisco IOS (12.2, 12.4, 15.0–15.6) and Cisco IOS XE (3.3–3.7). The flaw is in the DHCP client parsing code, allowing an unauthenticated, remote attacker to trigger a DoS by sending crafted DHCP packets, potentially causing a device reload. Affects devices configured as DHCP c...

CVE-2017-3858

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could...

CVE-2017-3859

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted...

CVE-2017-3856

A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. A...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in its IOS, IOS XE, and IOx Software. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system or cause a denial-of-service condition. Users and administrators are encouraged to...

Input validation

A vulnerability in the Autonomic Networking Infrastructure ANI registrar feature of Cisco IOS Software possibly 15.2 through 15.6 and Cisco IOS XE Software possibly 3.7 through 3.18, and 16 could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition. The...

Input validation

A vulnerability in the Autonomic Networking Infrastructure ANI feature of Cisco IOS Software 15.4 through 15.6 and Cisco IOS XE Software 3.7 through 3.18, and 16 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to incomplete inpu...

CVE-2017-3850

A vulnerability in the Autonomic Networking Infrastructure ANI feature of Cisco IOS Software 15.4 through 15.6 and Cisco IOS XE Software 3.7 through 3.18, and 16 could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to incomplete inpu...