CVE-2025-32433

The CVE-2025-32433 issue affects Erlang/OTP’s SSH server and is caused by a flaw in SSH message handling during authentication, enabling an unauthenticated attacker to execute arbitrary commands with the SSH daemon’s privileges (potentially root). Affected OTP versions include OTP-27.3.2?3, OTP-2...

CVE-2023-20046

Cisco StarOS Software contains a vulnerability in the key-based SSH authentication feature that could let an authenticated, low-privilege SSH key grant an attacker login as a high-privileged user. The issue stems from insufficient validation of user-supplied credentials, enabling privilege escala...

CVE-2019-16026

Cisco CVE-2019-16026 affects the SCTP implementation in Cisco Mobility Management Entity (MME). Affected component: SCTP input validation in MME could be exploited by a remote attacker in a MITM position between the eNodeB and the MME to send a crafted SCTP message, causing the MME to stop sendin...

CVE-2022-20665

CVE-2022-20665 is a Cisco StarOS command-injection vulnerability in the CLI. It arises from insufficient input validation of CLI commands, enabling an authenticated, local attacker with administrative credentials to execute arbitrary code with root privileges on an affected device. Exploitation w...

CVE-2020-3602

CVE-2020-3602 affects Cisco StarOS on Cisco ASR 5000 Series routers. The issue stems from insufficient input validation in the CLI, allowing an authenticated, local attacker with valid credentials to craft CLI commands and execute arbitrary code with root privileges. Documents consistently descri...

CVE-2021-1539

CVE-2021-1539 concerns multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) that allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI commands on an affected device. The issue stems from weaknesses in the authoriza...

CVE-2020-3601

CVE-2020-3601 affects Cisco StarOS on ASR 5000 Series Routers. The vulnerability arises from insufficient input validation in the CLI, enabling an authenticated, local attacker with administrative credentials to execute arbitrary code with root privileges. Reports describe privilege escalation by...

CVE-2021-1540

CVE-2021-1540 concerns Cisco ASR 5000 Series Software (StarOS). The advisory describes multiple vulnerabilities in the authorization process that could allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI commands on an affected device. The issue is tied to ...

CVE-2021-1145

CVE-2021-1145 affects Cisco StarOS for the Cisco ASR 5000 Series Routers. The vulnerability is due to insecure handling of symbolic links in Secure FTP (SFTP); with valid credentials, an authenticated attacker could read arbitrary files on the device by sending a crafted SFTP command. Cisco’s adv...

CVE-2020-3500

CVE-2020-3500 affects Cisco StarOS IPv6 handling. The vulnerability arises from insufficient validation of incoming IPv6 traffic in StarOS, allowing an unauthenticated, remote attacker to trigger a DoS by sending crafted IPv6 packets, causing the device to reload. IPv4 traffic is unaffected. Conn...

CVE-2020-3244

Cisco ASR 5000 Series Aggregation Services Routers contain an input validation flaw in the Enhanced Charging Service (ECS) feature that allows an unauthenticated, remote attacker to bypass traffic classification rules by sending a malformed HTTP request. The impact is the ability to avoid chargin...

CVE-2021-1353

Cisco StarOS IPv4 DoS (CVE-2021-1353): memory leak in IPv4 packet processing allows unauthenticated remote attackers to exhaust memory and trigger npusim restarts, causing DoS. Affected: Cisco StarOS. Exploit involves sending crafted IPv4 packets. Remediation: Cisco has released software updates;...

CVE-2018-0115

Cisco StarOS CLI Command Injection (CVE-2018-0115) affects Cisco ASR 5000 Series routers. A vulnerability in the StarOS CLI allows an authenticated local attacker to inject commands and execute arbitrary commands with root privileges due to insufficient input validation. Exploitation requires val...