Cisco Ios Xe Software vulnerabilities

CVE-2019-1759 [MEDIUM] CWE-284 CVE-2019-1759: A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interf A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the Gigabit Ethernet Management interface. The vulnerability is due to a logic error that was introduced in the Cisco IOS XE Software 16

CVE-2021-1382 [MEDIUM] CWE-77 CVE-2021-1382: A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attac A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to

CVE-2021-1383 [MEDIUM] CWE-20 CVE-2021-1383: Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, lo Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation of certain CLI commands. An attacker could exploit these vulnerabilities by authenticating to the device and submi

CVE-2019-12661 [MEDIUM] CWE-77 CVE-2019-12661: A vulnerability in a Virtualization Manager (VMAN) related CLI command of Cisco IOS XE Software coul A vulnerability in a Virtualization Manager (VMAN) related CLI command of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific VMAN CLI command on th

CVE-2022-20855 [MEDIUM] CWE-266 CVE-2022-20855: A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Con A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper chec

CVE-2022-20676 [MEDIUM] CWE-250 CVE-2022-20676: A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root-level privileges. This vulnerability is due to insufficient input validation of data that is passed into the Tcl interpreter. An attacker could exploit this vulnerability by l

CVE-2021-34723 [MEDIUM] CWE-668 CVE-2021-34723: A vulnerability in a specific CLI command that is run on Cisco IOS XE SD-WAN Software could allow an A vulnerability in a specific CLI command that is run on Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the configuration database of an affected device. This vulnerability is due to insufficient validation of specific CLI command parameters. An attacker could exploit this vulnerability by i

CVE-2021-1376 [MEDIUM] CWE-347 CVE-2021-1376: Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Cataly Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Series Switches could allow an authenticated, local attacker to either execute arbitrary code on the underlying operating system, install and boot a malicious software image, or execute unsigned bin

CVE-2021-1375 [MEDIUM] CWE-347 CVE-2021-1375: Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Cataly Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Series Switches could allow an authenticated, local attacker to either execute arbitrary code on the underlying operating system, install and boot a malicious software image, or execute unsigned bin

CVE-2024-20414 [MEDIUM] CWE-285 CVE-2024-20414: A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration changes through the HTTP GET method. An attacker could e

CVE-2026-20113 [MEDIUM] CWE-93 CVE-2026-20113: A vulnerability in the web-based Cisco IOx application hosting environment management interface of C A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulne

CVE-2021-34767 [HIGH] CWE-670 CVE-2021-34767: A vulnerability in IPv6 traffic processing of Cisco IOS XE Wireless Controller Software for Cisco Ca A vulnerability in IPv6 traffic processing of Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a Layer 2 (L2) loop in a configured VLAN, resulting in a denial of service (DoS) condition for that VLAN. The vulnerability is due to a logic error when p

CVE-2020-3494 [HIGH] CWE-20 CVE-2020-3494: Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of an affected device. These vulnerabilities are due to insufficient val

CVE-2020-3508 [HIGH] CWE-400 CVE-2020-3508: A vulnerability in the IP Address Resolution Protocol (ARP) feature of Cisco IOS XE Software for Cis A vulnerability in the IP Address Resolution Protocol (ARP) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers with a 20-Gbps Embedded Services Processor (ESP) installed could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service condition. The vulnerabili

CVE-2021-1621 [HIGH] CWE-399 CVE-2021-1621: A vulnerability in the Layer 2 punt code of Cisco IOS XE Software could allow an unauthenticated, ad A vulnerability in the Layer 2 punt code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a queue wedge on an interface that receives specific Layer 2 frames, resulting in a denial of service (DoS) condition. This vulnerability is due to improper handling of certain Layer 2 frames. An attacker could exploit this vulner

CVE-2023-20100 [MEDIUM] CWE-694 CVE-2023-20100: A vulnerability in the access point (AP) joining process of the Control and Provisioning of Wireless A vulnerability in the access point (AP) joining process of the Control and Provisioning of Wireless Access Points (CAPWAP) protocol of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic erro

CVE-2018-0481 [MEDIUM] CWE-77 CVE-2018-0481: A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attac A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exist because the affected software improperly sanitizes command arguments, failing to prevent access to certain internal data structures

CVE-2018-0477 [MEDIUM] CWE-77 CVE-2018-0477: A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attac A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exist because the affected software improperly sanitizes command arguments, failing to prevent access to certain internal data structures

CVE-2018-15368 [MEDIUM] CWE-20 CVE-2018-15368: A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attac A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent modifications

CVE-2021-1390 [MEDIUM] CWE-123 CVE-2021-1390: A vulnerability in one of the diagnostic test CLI commands of Cisco IOS XE Software could allow an a A vulnerability in one of the diagnostic test CLI commands of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker would need to have valid user credentials at privilege level 15. This vulnerability exists because the affected software permits mo