Cisco Enterprise Nfv Infrastructure Software vulnerabilities

CVE-2021-34746 [CRITICAL] CWE-289 CVE-2021-34746: A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco E A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and log in to an affected device as an administrator. This vulnerability is due to incomplete validation of user-supplied input th

CVE-2026-20093 [CRITICAL] CWE-20 CVE-2026-20093: A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by sending a

CVE-2019-1971 [CRITICAL] CWE-78 CVE-2019-1971: A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allo A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command injection attack and execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the web portal framework. An attacker could exploit this vulne

CVE-2022-20777 [CRITICAL] CWE-284 CVE-2022-20777: Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an atta Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this ad

CVE-2019-1895 [CRITICAL] CWE-306 CVE-2019-1895: A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NF A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to access the VNC console session of an administrative user on an affected device. The vulnerability is due to an insufficient authentication mechanism used to establish

CVE-2022-20779 [HIGH] CWE-284 CVE-2022-20779: Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an atta Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this adviso

CVE-2022-20655 [HIGH] CWE-78 CVE-2022-20655: A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an au A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of

CVE-2022-20780 [HIGH] CWE-284 CVE-2022-20780: Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an atta Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this adviso

CVE-2020-3478 [HIGH] CWE-20 CVE-2020-3478: A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading

CVE-2019-1894 [HIGH] CWE-20 CVE-2019-1894: A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite or read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to improper input validation in NFVIS filesystem commands. An attacker could exploi

CVE-2026-20095 [MEDIUM] CWE-77 CVE-2026-20095: A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit thi

CVE-2026-20096 [MEDIUM] CWE-77 CVE-2026-20096: A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit thi

CVE-2021-1421 [HIGH] CWE-78 CVE-2021-1421: A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to perform a command injection attack on an affected device. The vulnerability is due to insufficient validation of user-supplied input to a configuration command. An attacker could exploit this vulnerability by including malicious input d

CVE-2018-15402 [HIGH] CWE-352 CVE-2018-15402: A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticat A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker could exploit this vulnerability by convincing a ta

CVE-2019-1893 [HIGH] CWE-77 CVE-2019-1893: A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected device as root. The vulnerability is due to insufficient input validation of a configuration file that is accessible to a local shell user. An attacker co

CVE-2018-0460 [MEDIUM] CWE-285 CVE-2018-0460: A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an affected system. The vulnerability is due to insufficient authorization and parameter validation checks. An attacker could exploit this vulnerability by sending a malicious API request with the aut

CVE-2020-3365 [MEDIUM] CWE-22 CVE-2020-3365: A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directory permissions. An attacker could exploit this vulnerab

CVE-2019-1984 [MEDIUM] CWE-20 CVE-2019-1984: A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite files on the underlying operating system (OS) of an affected device. The vulnerability is due to improper input validation in an NFVIS file-system command. An attac

CVE-2019-1953 [MEDIUM] CWE-532 CVE-2019-1953: A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allo A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when logging in to the web portal for the first time. Subsequen

CVE-2019-1946 [MEDIUM] CWE-287 CVE-2019-1946: A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Softwar A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementation of authentication in the web-based management interf