CVE Vulnerability Advisory Database

[Affected Scope] Cisco devices running Cisco IOS and IOS XE Software with encapsulated DHCPv4 Option 82 restoration enabled

[Impact] An unauthenticated, remote attacker can cause an affected device to reload, resulting in a complete Denial of Service (DoS) condition

[Mitigation] Apply official software updates from Cisco or implement workarounds by hardening DHCP snooping and relay configurations

[Affected Scope] Cisco IOS and IOS XE Software with DHCP Option 82 relay functionality enabled

[Impact] Unauthenticated, remote attackers can trigger a heap overflow and force a device reload, leading to a complete Denial of Service (DoS)

[Mitigation] Apply official Cisco software updates immediately, or disable DHCP Option 82 relay features and restrict untrusted DHCP traffic

[Affected Scope] Cisco network switches and routers running Cisco IOS and IOS XE Software with the Smart Install client feature enabled.

[Impact] Unauthenticated, remote attackers can send crafted packets to TCP port 4786, triggering a heap-based buffer overflow that leads to device reload (DoS) or arbitrary code execution (RCE) with elevated privileges.

[Mitigation] Disable the Smart Install feature using the 'no vstack' command, or restrict access to TCP port 4786 using Infrastructure Access Control Lists (ACLs) if the feature is required.

[Affected Scope] Cisco IOS, IOS XE, and IOS XR Software with Link Layer Discovery Protocol (LLDP) enabled

[Impact] An unauthenticated, adjacent attacker could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) condition

[Mitigation] Apply official Cisco software updates or disable LLDP globally/per-interface as a temporary workaround

[Affected Scope] Cisco Catalyst 2960-L Series, Catalyst Digital Building Series 8P, and 8U Switches running vulnerable Cisco IOS and configured with SNMPv2 or SNMPv3.

[Impact] An authenticated remote attacker can trigger a device reload (Denial of Service) via a SYS-3-CPUHOG error by sending a crafted SNMP GET request for the ciscoFlashMIB OID.

[Mitigation] Apply the official Cisco IOS software updates, or implement SNMP MIB views to exclude access to the ciscoFlashMIB OID and restrict SNMP access using ACLs.

[Affected Scope] Cisco IOS and IOS XE Software configured with active Internet Key Exchange Version 1 (IKEv1) functionality.

[Impact] An unauthenticated, remote attacker can cause the affected device to reload by sending crafted IKEv1 packets, resulting in a complete Denial of Service (DoS) condition.

[Mitigation] Apply the official software updates provided by Cisco, or restrict IKEv1 traffic (UDP ports 500 and 4500) to trusted peer IP addresses using Access Control Lists (ACLs).

[Affected Scope] Cisco devices running Cisco IOS or Cisco IOS XE Software with the IKEv2 protocol enabled.

[Impact] An unauthenticated, remote attacker can trigger a continuous memory leak by sending crafted IKEv2 packets, eventually causing a device reload and a complete Denial of Service (DoS) condition.

[Mitigation] Apply the official Cisco software updates or restrict access to IKEv2 ports (UDP 500/4500) using Infrastructure Access Control Lists (iACLs).

[Affected Scope] Cisco switches running Cisco IOS or IOS XE Software with the Smart Install client feature enabled

[Impact] Unauthenticated, remote attackers can trigger an unexpected device reload, leading to a persistent Denial of Service (DoS) condition

[Mitigation] Disable the Smart Install feature using the 'no vstack' command, or restrict access to TCP port 4786 using infrastructure ACLs

[Affected Scope] Cisco Catalyst 4500, 4500-X, 4900M, and 4948E Series Switches with BFD hardware offload enabled

[Impact] Unauthenticated, remote attackers can transmit crafted BFD packets to trigger an iosd process crash, resulting in a complete system reload (DoS)

[Mitigation] Apply official Cisco IOS/IOS-XE software updates or disable BFD hardware offloading as a temporary workaround

[Affected Scope] Cisco router devices running Cisco IOS Software equipped with the Integrated Services Module for VPN (ISM-VPN).

[Impact] An unauthenticated, remote attacker can cause a complete Denial of Service (DoS) condition, hanging or crashing the device by sending crafted VPN traffic.

[Mitigation] Apply the official Cisco IOS software updates immediately and restrict unauthorized VPN traffic using Access Control Lists (ACLs).

[Affected Scope] Cisco IOS and IOS XE Software with the Quality of Service (QoS) subsystem enabled and listening on UDP port 18999.

[Impact] An unauthenticated, remote attacker can execute arbitrary code with elevated privileges or cause a denial of service (DoS) condition via device reload.

[Mitigation] Apply official Cisco software updates, or restrict access to UDP port 18999 using Infrastructure Access Control Lists (iACLs).

[Affected Scope] Cisco IOS XE Software releases prior to 16.3 with BGP EVPN configuration enabled

[Impact] Unauthenticated, remote attackers can trigger a device reload or corrupt the BGP routing table, leading to a complete Denial of Service (DoS) and network instability

[Mitigation] Upgrade to Cisco IOS XE Software release 16.3 or later, or disable EVPN configurations if not business-critical

[Affected Scope] Cisco Secure Access Control System (ACS) prior to release 5.8 Patch 9

[Impact] An unauthenticated, remote attacker can execute arbitrary commands on the affected device with root privileges by sending a crafted serialized Java object

[Mitigation] Immediately upgrade to Cisco ACS 5.8 Patch 9 or later, or restrict network access to vulnerable ports

[Affected Scope] Cisco network devices running Cisco IOS Software versions 12.2 through 15.6 or Cisco IOS XE Software with the DHCP relay subsystem enabled.

[Impact] An unauthenticated, remote attacker can execute arbitrary code with full system privileges (RCE) or trigger a system reload, causing a complete Denial of Service (DoS).

[Mitigation] Apply the official Cisco software updates immediately, or implement access control lists (ACLs) to block unauthorized DHCPv4 traffic and disable DHCP relay where not required.

[Affected Scope] Cisco Catalyst 6800 Series Switches running Cisco IOS 15.0 through 15.4, equipped with Supervisor Engine 6T and C6800-16P10G or C6800-16P10G-XL line cards configured as core-facing MPLS interfaces with VPLS enabled.

[Impact] An unauthenticated, adjacent attacker can flood the device with VPLS-generated MAC entries, causing the affected line card to crash and resulting in a complete Denial of Service (DoS) condition.

[Mitigation] Upgrade to a fixed Cisco IOS software release addressing Cisco Bug ID CSCva61927, or implement MAC address learning limits on VPLS VFIs as a temporary workaround.

[Affected Scope] Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 with ISAKMP enabled

[Impact] Unauthenticated, remote attackers can trigger high CPU utilization, traceback messages, or device reloads (DoS) by sending crafted IKEv2 packets

[Mitigation] Apply official Cisco software patches immediately, or restrict UDP 500/4500 traffic at the network boundary using Infrastructure ACLs (iACLs).

[Affected Scope] Cisco devices running Cisco IOS Software releases 12.2 through 15.6 configured to process PROFINET messages.

[Impact] An unauthenticated, remote attacker can cause the affected device to reload, resulting in a persistent Denial of Service (DoS) condition.

[Mitigation] Apply official Cisco IOS software updates, or disable the PROFINET protocol if it is not required in your environment.

[Affected Scope] Cisco IOS Software versions 12.4 through 15.6 with the Common Industrial Protocol (CIP) feature enabled

[Impact] An unauthenticated, remote attacker can cause the affected device to reload, resulting in a complete Denial of Service (DoS) condition

[Mitigation] Apply the official Cisco IOS software updates or restrict access to the CIP port (TCP/UDP 44818) using Access Control Lists (ACLs)

[Affected Scope] Cisco IOS Software versions 12.4 through 15.6 with the Common Industrial Protocol (CIP) feature enabled.

[Impact] An unauthenticated, remote attacker can cause the affected device to reload, resulting in a complete Denial of Service (DoS) condition.

[Mitigation] Apply official Cisco software updates or implement Infrastructure Access Control Lists (iACLs) to restrict unauthorized CIP traffic.

[Affected Scope] Cisco Integrated Services Routers Generation 2 (ISR G2) running Cisco IOS Software versions 15.0 through 15.6.

[Impact] An unauthenticated, adjacent attacker can cause the affected device to reload, leading to a complete Denial of Service (DoS) condition.

[Mitigation] Apply the official Cisco IOS software updates or implement Layer 2 security controls to restrict unauthorized adjacent traffic.