CVE Vulnerability Advisory Database

[Affected Scope] Cisco IOS 15.1, 15.2, 15.4 and IOS XE versions 3.14 through 3.18.

[Impact] An unauthenticated, remote attacker can send UDP packets with a destination port of 0 to cause an interface queue wedge, leading to a complete Denial of Service (DoS) condition.

[Mitigation] Upgrade to the latest recommended Cisco IOS/IOS XE software releases, or implement Infrastructure Access Control Lists (iACLs) to drop UDP packets targeting destination port 0.

[Affected Scope] Cisco network devices running Cisco IOS or IOS XE Software with the Autonomic Networking feature enabled (specifically Denali-16.2.1, Denali-16.3.1)

[Impact] An unauthenticated, adjacent attacker can cause affected autonomic nodes to reload, leading to a complete Denial of Service (DoS) condition

[Mitigation] Apply official Cisco software updates or disable the Autonomic Networking Infrastructure (ANI) feature if not required

[Affected Scope] Cisco IOS and IOS XE Software with SNMP enabled and affected MIBs/OIDs not explicitly excluded

[Impact] An authenticated, remote attacker can execute arbitrary code with full system control or cause a denial of service (system reload)

[Mitigation] Apply official Cisco software updates, or implement workarounds by restricting SNMP views to exclude vulnerable MIBs and enforcing ACLs

[Affected Scope] Cisco IOS and IOS XE Software with SNMP enabled and affected MIBs/OIDs not explicitly excluded

[Impact] Authenticated remote attackers can execute arbitrary code with full system privileges or trigger a device reload (DoS) via crafted SNMP packets

[Mitigation] Apply official Cisco software updates, restrict SNMP access using ACLs, enforce strong community strings/credentials, or disable vulnerable MIB views

[Affected Scope] Cisco IOS and IOS-XE devices with active SNMP services and exposed valid credentials (community strings or SNMPv3 users)

[Impact] An authenticated remote attacker can send crafted SNMP packets to trigger a buffer overflow, causing a system reload (DoS) or executing arbitrary code with full administrative privileges

[Mitigation] Apply official Cisco software updates, restrict SNMP access using strict Access Control Lists (ACLs), or disable SNMP services if not required

[Affected Scope] All Cisco devices running Cisco IOS or IOS XE software with SNMP enabled and affected MIBs/OIDs not explicitly excluded

[Impact] An authenticated, remote attacker can execute arbitrary code with full system privileges or trigger a device reload, causing a complete Denial of Service (DoS)

[Mitigation] Apply official software updates via Cisco IOS Software Checker, or implement workarounds including SNMP View restrictions and Access Control Lists (ACLs)

[Affected Scope] Cisco IOS and IOS-XE devices with active SNMP services and exposed community strings or user credentials.

[Impact] Authenticated remote attackers can trigger a buffer overflow via crafted SNMP packets, leading to system reload (DoS) or full remote code execution (RCE) with administrative privileges.

[Mitigation] Apply official Cisco software updates, restrict SNMP access using strict Access Control Lists (ACLs), or disable SNMP services if not required.

[Affected Scope] Cisco IOS and IOS XE Software with SNMP enabled and affected MIBs/OIDs not explicitly excluded

[Impact] Authenticated remote attackers can execute arbitrary code with full system control or trigger a device reload by sending crafted SNMP packets

[Mitigation] Apply official software updates via Cisco IOS Software Checker, or implement SNMPv3 hardening and MIB filtering workarounds

[Affected Scope] Cisco IOS and IOS-XE network devices with active SNMP services and exposed valid credentials (community strings or SNMPv3 user credentials).

[Impact] An authenticated, remote attacker can send crafted SNMP packets to trigger a buffer overflow, leading to a system reload or arbitrary remote code execution (RCE) with full administrative control.

[Mitigation] Apply official Cisco software patches immediately, or restrict SNMP access using Infrastructure ACLs and enforce complex community strings as a temporary workaround.

[Affected Scope] All Cisco devices running Cisco IOS and IOS XE Software with SNMP enabled and affected MIBs/OIDs not explicitly excluded

[Impact] Authenticated remote attackers can execute arbitrary code with full system privileges or trigger a device reload, leading to complete infrastructure compromise or denial of service

[Mitigation] Apply fixed software versions via Cisco IOS Software Checker, or implement workarounds including SNMP community ACLs, MIB view restrictions, or disabling SNMP

[Affected Scope] Cisco IOS and IOS XE-based Catalyst switches and embedded service modules configured to accept Telnet connections and utilizing CMP

[Impact] Unauthenticated, remote attackers can execute arbitrary code with elevated privileges or cause a device reload by sending malformed CMP-specific Telnet options

[Mitigation] Apply official Cisco software updates immediately, or disable Telnet services and restrict VTY access using infrastructure ACLs

[Affected Scope] Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0

[Impact] Unauthenticated remote attackers can retrieve sensitive information from device memory (including private keys and configuration data) by sending crafted IKEv1 negotiation requests

[Mitigation] Upgrade affected device firmware to the latest patched releases, or restrict access to UDP ports 500 and 4500 using infrastructure ACLs to trusted peers only

[Affected Scope] Cisco ASA Software prior to version 8.4(1) running on ASA 5500, ASA 5500-X, PIX, and FWSM devices

[Impact] Local authenticated attackers can execute invalid CLI commands to bypass access controls, escalate privileges to root, and fully compromise the device

[Mitigation] Upgrade Cisco ASA Software to version 8.4(1) or later, and restrict CLI access (SSH/Console) using strict AAA and firewall rules

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, 5500-X, ASAv, Firepower 9300, PIX, and FWSM devices

[Impact] Remote authenticated attackers can exploit this vulnerability to execute arbitrary code (RCE) with elevated privileges or cause a denial of service (DoS) via crafted IPv4 SNMP packets

[Mitigation] Apply official Cisco software updates immediately, restrict SNMP access using strict Access Control Lists (ACLs), and rotate SNMP community strings

[Affected Scope] Cisco Prime Data Center Network Manager (DCNM) versions prior to 7.1(1)

[Impact] Unauthenticated remote attackers can read arbitrary system files by sending crafted HTTP requests containing directory traversal sequences

[Mitigation] Immediately upgrade Cisco DCNM to version 7.1(1) or later, and restrict access to the DCNM management interface

[Affected Scope] Cisco Adaptive Security Appliance (ASA) Software with WebVPN (SSL VPN) feature enabled

[Impact] Remote attackers can execute arbitrary JavaScript or HTML code in the context of the user's browser session, leading to session hijacking or credential theft

[Mitigation] Apply official Cisco software updates, restrict WebVPN access via ACLs, and monitor HTTP request logs

[Affected Scope] Cisco IOS XR software versions 3.4.0 through 3.9.1 with the Border Gateway Protocol (BGP) routing process enabled.

[Impact] A remote attacker can trigger a denial of service (BGP peering session reset) by sending a specially crafted BGP prefix announcement, potentially disrupting global routing tables.

[Mitigation] Apply the official Cisco Software Maintenance Upgrade (SMU) or upgrade to a non-vulnerable release of Cisco IOS XR.

[Affected Scope] Cisco IOS XR Software versions 3.4.0 through 3.8.1 running on routing platforms

[Impact] Remote attackers can trigger a denial of service (BGP session reset) by sending a crafted BGP UPDATE message with an invalid attribute, leading to routing instability

[Mitigation] Apply official Cisco software patches or implement infrastructure ACLs and BGP TTL Security to restrict unauthorized BGP peer connections

[Affected Scope] Cisco 871 Integrated Services Routers (ISR) running Cisco IOS 12.4 with the HTTP Administration component enabled.

[Impact] Remote attackers can execute arbitrary commands with privilege level 15 by tricking an authenticated administrator into visiting a malicious link, leading to complete device compromise.

[Mitigation] Disable the HTTP/HTTPS server on the router, restrict access using IP-based Access Control Lists (ACLs), or upgrade to a patched Cisco IOS release.

[Affected Scope] Cisco IOS 12.2(15) and earlier versions

[Impact] Remote attackers can cause a denial of service (refused VTY connections) by exhausting virtual terminal resources using crafted TCP connection requests

[Mitigation] Upgrade to a patched Cisco IOS release, disable Telnet in favor of SSH, and restrict VTY access using Access Control Lists (ACLs)