Cisco Ios Xe Software vulnerabilities

CVE-2021-1454 [MEDIUM] CWE-20 CVE-2021-1454: Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, lo Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation of certain CLI commands. An attacker could exploit these vulnerabilities by authenticating to the device and submi

CVE-2025-20313 [MEDIUM] CWE-35 CVE-2025-20313: Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker wi Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust. These vulnerabilities are due path traversal and improper image integrity validation. A succe

CVE-2025-20201 [MEDIUM] CWE-754 CVE-2025-20201: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker wit A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device. This vulnerability is due to insufficient input validation when processing specific configuration commands. An attacker could exploit this vul

CVE-2026-20104 [MEDIUM] CWE-124 CVE-2026-20104: A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9300 Embedded Series Switches, Cisco Catalyst IE9310 and IE9320 Rugged Series Switches, and Cisco IE3500 and IE3505 Rugged Series Switches could allow an authenticated, local attacker with level-15 privileges or an unauthenticated att

CVE-2026-20115 [MEDIUM] CWE-319 CVE-2026-20115: A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated atta A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information. This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device

CVE-2025-20155 [MEDIUM] CWE-1287 CVE-2025-20155: A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, loca A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is first deployed in SD-WAN mode or when an administrator co

CVE-2018-0471 [HIGH] CWE-400 CVE-2018-0471: A vulnerability in the Cisco Discovery Protocol (CDP) module of Cisco IOS XE Software Releases 16.6. A vulnerability in the Cisco Discovery Protocol (CDP) module of Cisco IOS XE Software Releases 16.6.1 and 16.6.2 could allow an unauthenticated, adjacent attacker to cause a memory leak that may lead to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain CDP packets. An attacker could exploit this vulnerabili

CVE-2019-1749 [HIGH] CWE-20 CVE-2019-1749: A vulnerability in the ingress traffic validation of Cisco IOS XE Software for Cisco Aggregation Ser A vulnerability in the ingress traffic validation of Cisco IOS XE Software for Cisco Aggregation Services Router (ASR) 900 Route Switch Processor 3 (RSP3) could allow an unauthenticated, adjacent attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability exists because the software insufficient

CVE-2020-3396 [HIGH] CWE-284 CVE-2020-3396: A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored o

CVE-2022-20692 [MEDIUM] CWE-400 CVE-2022-20692: A vulnerability in the NETCONF over SSH feature of Cisco IOS XE Software could allow a low-privilege A vulnerability in the NETCONF over SSH feature of Cisco IOS XE Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service condition (DoS) on an affected device. This vulnerability is due to insufficient resource management. An attacker could exploit this vulnerability by initiating a large number of NETCONF o

CVE-2020-3513 [MEDIUM] CWE-749 CVE-2020-3513: Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services Routers with a Route Switch Processor 3 (RSP3) installed could allow an authenticated, local attacker with high privileges to execute persistent code at bootup and break the chain of trust. Thes

CVE-2020-3416 [MEDIUM] CWE-749 CVE-2020-3416: Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services Routers with a Route Switch Processor 3 (RSP3) installed could allow an authenticated, local attacker with high privileges to execute persistent code at bootup and break the chain of trust. Thes

CVE-2025-20314 [MEDIUM] CWE-232 CVE-2025-20314: A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to an affected device to execute persistent code at boot time and break the chain of trust. This vulnerability is due to improper validation of software packages. An attacker could exploit

CVE-2021-34696 [MEDIUM] CWE-284 CVE-2021-34696: A vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Agg A vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incorrect programming of hardware when an ACL is configured using a method other than the configuration CLI. An attacker

CVE-2019-1742 [MEDIUM] CWE-16 CVE-2019-1742: A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attack A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious request to an affected device. A successful exploit coul

CVE-2025-20194 [MEDIUM] CWE-78 CVE-2025-20194: A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authen A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based mana

CVE-2019-1750 [HIGH] CWE-20 CVE-2019-1750: A vulnerability in the Easy Virtual Switching System (VSS) of Cisco IOS XE Software on Catalyst 4500 A vulnerability in the Easy Virtual Switching System (VSS) of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, adjacent attacker to cause the switches to reload. The vulnerability is due to incomplete error handling when processing Cisco Discovery Protocol (CDP) packets used with the Easy Virtual Switching System. An

CVE-2021-1398 [MEDIUM] CWE-489 CVE-2021-1398: A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attac A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker with physical access to execute arbitrary code on the underlying Linux operating system of an affected device. This vulnerability is due to incorrect validations of specific function arguments

CVE-2022-20944 [MEDIUM] CWE-347 CVE-2022-20944: A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to an improper check in the code function that manages the verification of the digital signatures of

CVE-2018-15371 [MEDIUM] CWE-284 CVE-2018-15371: A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authen A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. An attacker