Cisco Ios Xe Software vulnerabilities

CVE-2022-20684 [MEDIUM] CWE-190 CVE-2022-20684: A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition on the device. This vulnerab

CVE-2025-20149 [MEDIUM] CWE-120 CVE-2025-20149: A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authentica A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a buffer overflow. An attacker with a low-privileged account could exploit this vulnerability by usi

CVE-2024-20310 [MEDIUM] CWE-23 CVE-2024-20310: A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Ser A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an authenticated user of the interface. This vulnerability exists because the web-based management interface does not properly

CVE-2024-20324 [MEDIUM] CWE-274 CVE-2024-20324: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, low-privileged, lo A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, low-privileged, local attacker to access WLAN configuration details including passwords. This vulnerability is due to improper privilege checks. An attacker could exploit this vulnerability by using the show and show tech wireless CLI commands to access configuration d

CVE-2020-3429 [MEDIUM] CWE-20 CVE-2020-3429: A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Sof A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect packet processing during the WPA2 and WPA3 authentication h

CVE-2020-3486 [MEDIUM] CWE-20 CVE-2020-3486: Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of an affected device. These vulnerabilities are due to insufficient v

CVE-2020-3487 [MEDIUM] CWE-20 CVE-2020-3487: Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of an affected device. These vulnerabilities are due to insufficient v

CVE-2021-1352 [MEDIUM] CWE-823 CVE-2021-1352: A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software c A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of DECnet traffic that is received by an affected device. An attacker could ex

CVE-2023-20067 [MEDIUM] CWE-770 CVE-2023-20067: A vulnerability in the HTTP-based client profiling feature of Cisco IOS XE Software for Wireless LAN A vulnerability in the HTTP-based client profiling feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of received traffic. An attacker could exploit this vu

CVE-2023-20202 [MEDIUM] CWE-789 CVE-2023-20202: A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper memory management. An attacker could exploit this vulnerability by sending a series of network request

CVE-2026-20110 [MEDIUM] CWE-266 CVE-2026-20110: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because incorrect privileges are associated with the start maintenance command. An attacker could exploit this vulnerability by accessing the management CLI of t

CVE-2026-20083 [MEDIUM] CWE-235 CVE-2026-20083: A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allo A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of a malformed SCP request. An attacker could exploit this vulnerability by issui

CVE-2021-1616 [MEDIUM] CWE-693 CVE-2021-1616: A vulnerability in the H.323 application level gateway (ALG) used by the Network Address Translation A vulnerability in the H.323 application level gateway (ALG) used by the Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass the ALG. This vulnerability is due to insufficient data validation of traffic that is traversing the ALG. An attacker could exploit this vulnerability by s

CVE-2020-3516 [MEDIUM] CWE-20 CVE-2020-3516: A vulnerability in the web server authentication of Cisco IOS XE Software could allow an authenticat A vulnerability in the web server authentication of Cisco IOS XE Software could allow an authenticated, remote attacker to crash the web server on the device. The vulnerability is due to insufficient input validation during authentication. An attacker could exploit this vulnerability by entering unexpected characters during a valid authentication. A su

CVE-2020-3428 [MEDIUM] CWE-20 CVE-2020-3428: A vulnerability in the WLAN Local Profiling feature of Cisco IOS XE Wireless Controller Software for A vulnerability in the WLAN Local Profiling feature of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect parsing of HTTP packets while performing HTTP-based endpoint devic

CVE-2026-20308 [MEDIUM] CWE-269 CVE-2026-20308: A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authen A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to

CVE-2018-0480 [MEDIUM] CWE-362 CVE-2018-0480: A vulnerability in the errdisable per VLAN feature of Cisco IOS XE Software could allow an unauthent A vulnerability in the errdisable per VLAN feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause the device to crash, leading to a denial of service (DoS) condition. The vulnerability is due to a race condition that occurs when the VLAN and port enter an errdisabled state, resulting in an incorrect state in the so

CVE-2025-20214 [MEDIUM] CWE-639 CVE-2025-20214: A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software c A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data. This vulnerability exists because a subtle change in inner API call behavior causes results to be filtered incorrectly. An attacker c

CVE-2026-20112 [MEDIUM] CWE-79 CVE-2026-20112: A vulnerability in the web-based Cisco IOx application hosting environment management interface of C A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability is due to insufficient validation of

CVE-2025-20195 [MEDIUM] CWE-352 CVE-2025-20195: A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauth A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a CSRF attack and execute commands on the CLI of an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could expl