CVE-2023-20036

CVE-2023-20036 affects Cisco Industrial Network Director (IND). The issue is in the web UI and arises from improper input validation during Device Pack uploads, allowing an authenticated, remote attacker to inject commands and execute arbitrary code with NT AUTHORITY\SYSTEM privileges on the devi...

CVE-2019-1976

Cisco Industrial Network Director (IND) is affected by a vulnerability in the plug‑and‑play services component that allows an unauthenticated, remote attacker to access sensitive information via the web management interface. The root cause is improper access restrictions, enabling an attacker to ...

CVE-2023-20039

CVE-2023-20039 – Cisco IND : A vulnerability in Cisco Industrial Network Director (IND) allows an authenticated, local attacker to read files in the application data directory due to insufficient default file permissions. This could enable viewing sensitive information. Cisco states software upda...

CVE-2023-20037

CVE-2023-20037 affects Cisco Industrial Network Director (IND). Connected sources confirm a stored cross-site scripting (XSS) vulnerability caused by improper validation of content submitted to the affected application. An authenticated, remote attacker could send malicious payloads to execute sc...

CVE-2019-15973

Cisco Industrial Network Director (IND) web-based management interface is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2019-15973). The issue arises from insufficient validation of user-supplied input, enabling an unauthenticated, remote attacker to lure a user into click...

CVE-2023-20038

CVE-2023-20038 affects Cisco Industrial Network Director (IND). The issue is a static secret key used to encrypt application data and remote credentials, stored in the monitoring application. An authenticated, local attacker with access to the host could decrypt data to access remote systems moni...

CVE-2019-1881

CVE-2019-1881 affects Cisco Industrial Network Director (IND) web-based management interface. The issue is a CSRF vulnerability caused by insufficient CSRF protections, allowing an unauthenticated, remote attacker to induce a logged-in user to perform arbitrary actions on an affected device by co...

CVE-2019-1861

Cisco Industrial Network Director (IND) remote code execution (CVE-2019-1861) is caused by improper validation of uploaded files in the software update feature. An authenticated administrator can upload an arbitrary file, leading to code execution with elevated privileges. Affected are IND releas...

CVE-2019-1882

The CVE-2019-1882 issue affects Cisco Industrial Network Director. It is a stored XSS vulnerability caused by improper validation of content submitted to the affected application. An authenticated, remote attacker could exploit this by sending requests containing malicious values, enabling stored...

CVE-2020-3567

CVE-2020-3567 affects Cisco Industrial Network Director (IND) via the management REST API. Affected versions prior to 1.9.0 (per CNVD entry) expose a vulnerability where insufficient validation of REST requests allows an authenticated, remote attacker to trigger high CPU utilization, causing a pe...

CVE-2019-1940

Affects Cisco Industrial Network Director (IND) Web Services Management Agent (WSMA). The issue arises from insufficient validation of X.509 certificates during WSMA connection setup, allowing an unauthenticated, remote attacker to read sensitive data via a crafted certificate, enabling man-in-th...

CVE-2017-6675

CVE-2017-6675 is a cross-site scripting (XSS) vulnerability in the web interface of Cisco Industrial Network Director. The issue comes from insufficient validation of user-supplied input in URLs, allowing an unauthenticated, remote attacker to trigger a reflected XSS in affected systems. Affected...

CVE-2018-15392

CVE-2018-15392 concerns Cisco Industrial Network Director. The DHCP service is vulnerable to denial-of-service from an unauthenticated, adjacent attacker due to improper handling of DHCP lease requests, which could cause the DHCP service to terminate. Exploitation details are not provided in the ...