CVE Vulnerability Advisory Database

[Affected Scope] Cisco Secure Firewall ASA (Adaptive Security Appliance) and FTD (Threat Defense) software with VPN web server features enabled

[Impact] An authenticated remote attacker with valid VPN credentials can execute arbitrary code with root privileges, leading to complete compromise of the device

[Mitigation] Apply official vendor security patches immediately, enforce Multi-Factor Authentication (MFA) on all VPN accounts, and monitor HTTP traffic logs

[Affected Scope] All versions of Cisco IOS and Cisco IOS XE Software with active SNMP services

[Impact] Authenticated attackers can trigger a system reload (DoS) or execute arbitrary code with root privileges (RCE) via crafted SNMP packets

[Mitigation] Apply official Cisco software updates immediately, restrict SNMP access via ACLs, or disable unused SNMP services

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the API ports from untrusted networks

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system by sending a crafted API request

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the management API ports

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software with Remote Access VPN (RAVPN) service enabled

[Impact] Unauthenticated, remote attackers can exhaust system resources by flooding VPN authentication requests, leading to a Denial of Service (DoS) of the RAVPN service and potentially requiring a device reload

[Mitigation] Apply official Cisco security patches immediately, configure connection rate limiting, and block malicious brute-force IP addresses

[Affected Scope] Cisco Smart Licensing Utility (CSLU) versions prior to 2.3.0

[Impact] Unauthenticated remote attackers can gain full administrative access to the CSLU application API using hardcoded static credentials

[Mitigation] Immediately upgrade CSLU to version 2.3.0 or later, and restrict external access to the CSLU API ports using firewalls

[Affected Scope] Cisco NX-OS Software running on Nexus series switches with authenticated Administrator credentials

[Impact] Authenticated administrators can bypass CLI sandboxing and execute arbitrary commands as root on the underlying Linux operating system due to insufficient argument validation

[Mitigation] Apply official Cisco NX-OS software updates immediately and restrict administrative CLI access using robust AAA and ACLs

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software

[Impact] An authenticated, local attacker with administrator privileges can execute arbitrary code with root-level privileges and establish persistence across device reboots by preloading crafted files

[Mitigation] Apply the official security updates provided by Cisco immediately and audit the flash file system for unauthorized files

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software with management or VPN web server enabled.

[Impact] An unauthenticated, remote attacker can trigger an unexpected device reload by sending a crafted HTTP request, leading to a complete Denial of Service (DoS) condition.

[Mitigation] Apply official Cisco software patches immediately. Restrict access to management interfaces and monitor VPN ports for anomalous HTTP headers as temporary workarounds.

[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled on network devices

[Impact] An authenticated, remote attacker can exploit insufficient input validation to inject arbitrary commands into the underlying operating system with root privileges, leading to complete system compromise

[Mitigation] Immediately disable the Web UI feature or upgrade to the latest patched Cisco IOS XE software release

[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled and exposed to the internet

[Impact] Unauthenticated remote attackers can bypass authentication to create a local user with Privilege 15 access, subsequently elevating to root to install a persistent malicious implant

[Mitigation] Immediately disable the Web UI (HTTP/HTTPS Server) feature or restrict access to trusted management networks, and upgrade to the recommended fixed software releases

[Affected Scope] Cisco IOS and Cisco IOS XE Software with the Group Encrypted Transport VPN (GET VPN) feature enabled

[Impact] An authenticated, remote attacker with administrative control over a key server or group member can execute arbitrary code or cause a device reload (DoS)

[Mitigation] Apply the official Cisco software updates and restrict GDOI/G-IKEv2 protocol access to authorized infrastructure nodes only

[Affected Scope] Remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software.

[Impact] Improper AAA separation allows unauthenticated remote attackers to conduct brute-force attacks to identify valid credentials or establish unauthorized clientless SSL VPN sessions.

[Mitigation] Apply official software updates from Cisco, or implement workarounds by redirecting default connection profile authentication to a loopback address and enforcing MFA.

[Affected Scope] Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers

[Impact] An authenticated, remote attacker can execute arbitrary commands with root-level privileges, leading to complete device compromise

[Mitigation] Since these devices are End-of-Life (EoL) and no patches will be released, administrators must disable remote management or replace the devices immediately

[Affected Scope] Systems and network devices running vulnerable versions of Cisco SD-WAN Software CLI

[Impact] An authenticated, local attacker can execute arbitrary commands with root privileges by running a maliciously crafted command

[Mitigation] Apply the official software updates provided by Cisco immediately, as there are no viable workarounds

[Affected Scope] Cisco IOS XR Software deployments with the Health Check RPM enabled

[Impact] Unauthenticated remote attackers can connect to the Redis instance inside the NOSi container, enabling them to write to the database, write arbitrary files to the container filesystem, and retrieve database information

[Mitigation] Apply official Cisco software updates, deactivate the unused Health Check RPM, or restrict access to TCP port 6379 using infrastructure ACLs

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] An authenticated, adjacent attacker can execute arbitrary code with root privileges or cause a denial of service (DoS) via stack-based buffer overflow and command injection

[Mitigation] Immediately apply the latest firmware patches provided by Cisco and restrict access to the web-based management interface

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated attackers can execute arbitrary code, elevate privileges, bypass authentication, and run unsigned software

[Mitigation] Apply the official Cisco firmware updates immediately and restrict access to the management interface

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Local attackers can trigger a stack-based buffer overflow to elevate privileges to root and execute arbitrary code

[Mitigation] Immediately apply the latest firmware updates provided by Cisco and restrict access to the management interface

[Affected Scope] Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers

[Impact] Unauthenticated remote attackers can execute arbitrary code, elevate privileges, bypass authentication, and run unsigned software to fully compromise the device

[Mitigation] Immediately apply the latest firmware patches provided by Cisco and disable remote WAN management access