CVE Vulnerability Advisory Database

[Affected Scope] All versions of Cisco IOS and Cisco IOS XE Software with active SNMP services

[Impact] Authenticated attackers can trigger a system reload (DoS) or execute arbitrary code with root privileges (RCE) via crafted SNMP packets

[Mitigation] Apply official Cisco software updates immediately, restrict SNMP access via ACLs, or disable unused SNMP services

[Affected Scope] Cisco IOS and Cisco IOS XE Software with the Group Encrypted Transport VPN (GET VPN) feature enabled

[Impact] An authenticated, remote attacker with administrative control over a key server or group member can execute arbitrary code or cause a device reload (DoS)

[Mitigation] Apply the official Cisco software updates and restrict GDOI/G-IKEv2 protocol access to authorized infrastructure nodes only

[Affected Scope] Cisco devices running Cisco IOS Software Release 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later with Login Enhancements (Login Block) enabled

[Impact] An unauthenticated, remote attacker can trigger an unexpected system reload, leading to a complete Denial of Service (DoS) condition

[Mitigation] Apply the official Cisco IOS software updates, or temporarily disable the 'login block-for' feature and restrict virtual terminal (vty) access using infrastructure ACLs

[Affected Scope] Cisco devices running Cisco IOS Software Releases 15.4(2)T, 15.4(3)M, or 15.4(2)CG and later with Login Enhancements (Login Block) enabled

[Impact] An unauthenticated, remote attacker can trigger an unexpected system reload, leading to a persistent Denial of Service (DoS) condition

[Mitigation] Upgrade to the latest patched Cisco IOS software release or temporarily disable/modify the Login Block configuration

[Affected Scope] Cisco IOS and IOS XE Software with DHCP Option 82 encapsulation functionality enabled

[Impact] An unauthenticated, remote attacker can cause the affected device to reload, resulting in a complete Denial of Service (DoS) condition

[Mitigation] Apply the official software updates from Cisco, or disable DHCP Option 82 / relay features and restrict DHCP traffic using ACLs

[Affected Scope] Cisco IOS, IOS XE, and IOS XR Software with Link Layer Discovery Protocol (LLDP) enabled

[Impact] An unauthenticated, adjacent attacker could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) condition

[Mitigation] Apply official Cisco software updates or disable LLDP globally/per-interface as a temporary workaround

[Affected Scope] Cisco Catalyst 2960-L Series, Catalyst Digital Building Series 8P, and 8U Switches running vulnerable Cisco IOS and configured with SNMPv2 or SNMPv3.

[Impact] An authenticated remote attacker can trigger a device reload (Denial of Service) via a SYS-3-CPUHOG error by sending a crafted SNMP GET request for the ciscoFlashMIB OID.

[Mitigation] Apply the official Cisco IOS software updates, or implement SNMP MIB views to exclude access to the ciscoFlashMIB OID and restrict SNMP access using ACLs.

[Affected Scope] Cisco IOS and IOS XE Software configured with active Internet Key Exchange Version 1 (IKEv1) functionality.

[Impact] An unauthenticated, remote attacker can cause the affected device to reload by sending crafted IKEv1 packets, resulting in a complete Denial of Service (DoS) condition.

[Mitigation] Apply the official software updates provided by Cisco, or restrict IKEv1 traffic (UDP ports 500 and 4500) to trusted peer IP addresses using Access Control Lists (ACLs).

[Affected Scope] Cisco Catalyst 4500, 4500-X, 4900M, and 4948E Series Switches with BFD hardware offload enabled

[Impact] Unauthenticated, remote attackers can transmit crafted BFD packets to trigger an iosd process crash, resulting in a complete system reload (DoS)

[Mitigation] Apply official Cisco IOS/IOS-XE software updates or disable BFD hardware offloading as a temporary workaround

[Affected Scope] Cisco router devices running Cisco IOS Software equipped with the Integrated Services Module for VPN (ISM-VPN).

[Impact] An unauthenticated, remote attacker can cause a complete Denial of Service (DoS) condition, hanging or crashing the device by sending crafted VPN traffic.

[Mitigation] Apply the official Cisco IOS software updates immediately and restrict unauthorized VPN traffic using Access Control Lists (ACLs).

[Affected Scope] Cisco IOS and IOS XE Software with the Quality of Service (QoS) subsystem enabled and listening on UDP port 18999.

[Impact] An unauthenticated, remote attacker can execute arbitrary code with elevated privileges or cause a denial of service (DoS) condition via device reload.

[Mitigation] Apply official Cisco software updates, or restrict access to UDP port 18999 using Infrastructure Access Control Lists (iACLs).

[Affected Scope] Cisco Catalyst 6800 Series Switches running Cisco IOS 15.0 through 15.4, equipped with Supervisor Engine 6T and C6800-16P10G or C6800-16P10G-XL line cards configured as core-facing MPLS interfaces with VPLS enabled.

[Impact] An unauthenticated, adjacent attacker can flood the device with VPLS-generated MAC entries, causing the affected line card to crash and resulting in a complete Denial of Service (DoS) condition.

[Mitigation] Upgrade to a fixed Cisco IOS software release addressing Cisco Bug ID CSCva61927, or implement MAC address learning limits on VPLS VFIs as a temporary workaround.

[Affected Scope] Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 with ISAKMP enabled

[Impact] Unauthenticated, remote attackers can trigger high CPU utilization, traceback messages, or device reloads (DoS) by sending crafted IKEv2 packets

[Mitigation] Apply official Cisco software patches immediately, or restrict UDP 500/4500 traffic at the network boundary using Infrastructure ACLs (iACLs).

[Affected Scope] Cisco devices running Cisco IOS Software releases 12.2 through 15.6 configured to process PROFINET messages.

[Impact] An unauthenticated, remote attacker can cause the affected device to reload, resulting in a persistent Denial of Service (DoS) condition.

[Mitigation] Apply official Cisco IOS software updates, or disable the PROFINET protocol if it is not required in your environment.

[Affected Scope] Cisco IOS Software versions 12.4 through 15.6 with the Common Industrial Protocol (CIP) feature enabled

[Impact] An unauthenticated, remote attacker can cause the affected device to reload, resulting in a complete Denial of Service (DoS) condition

[Mitigation] Apply the official Cisco IOS software updates or restrict access to the CIP port (TCP/UDP 44818) using Access Control Lists (ACLs)

[Affected Scope] Cisco IOS Software versions 12.4 through 15.6 with the Common Industrial Protocol (CIP) feature enabled.

[Impact] An unauthenticated, remote attacker can cause the affected device to reload, resulting in a complete Denial of Service (DoS) condition.

[Mitigation] Apply official Cisco software updates or implement Infrastructure Access Control Lists (iACLs) to restrict unauthorized CIP traffic.

[Affected Scope] Cisco Integrated Services Routers Generation 2 (ISR G2) running Cisco IOS Software versions 15.0 through 15.6.

[Impact] An unauthenticated, adjacent attacker can cause the affected device to reload, leading to a complete Denial of Service (DoS) condition.

[Mitigation] Apply the official Cisco IOS software updates or implement Layer 2 security controls to restrict unauthorized adjacent traffic.

[Affected Scope] Cisco IOS 15.1, 15.2, 15.4 and IOS XE versions 3.14 through 3.18.

[Impact] An unauthenticated, remote attacker can send UDP packets with a destination port of 0 to cause an interface queue wedge, leading to a complete Denial of Service (DoS) condition.

[Mitigation] Upgrade to the latest recommended Cisco IOS/IOS XE software releases, or implement Infrastructure Access Control Lists (iACLs) to drop UDP packets targeting destination port 0.

[Affected Scope] Cisco network devices running Cisco IOS or IOS XE Software with the Autonomic Networking feature enabled (specifically Denali-16.2.1, Denali-16.3.1)

[Impact] An unauthenticated, adjacent attacker can cause affected autonomic nodes to reload, leading to a complete Denial of Service (DoS) condition

[Mitigation] Apply official Cisco software updates or disable the Autonomic Networking Infrastructure (ANI) feature if not required

[Affected Scope] Cisco IOS and IOS XE-based Catalyst switches and embedded service modules configured to accept Telnet connections and utilizing CMP

[Impact] Unauthenticated, remote attackers can execute arbitrary code with elevated privileges or cause a device reload by sending malformed CMP-specific Telnet options

[Mitigation] Apply official Cisco software updates immediately, or disable Telnet services and restrict VTY access using infrastructure ACLs