CVE Vulnerability Advisory Database

[Affected Scope] All versions of Cisco IOS and Cisco IOS XE Software with active SNMP services

[Impact] Authenticated attackers can trigger a system reload (DoS) or execute arbitrary code with root privileges (RCE) via crafted SNMP packets

[Mitigation] Apply official Cisco software updates immediately, restrict SNMP access via ACLs, or disable unused SNMP services

[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled on network devices

[Impact] An authenticated, remote attacker can exploit insufficient input validation to inject arbitrary commands into the underlying operating system with root privileges, leading to complete system compromise

[Mitigation] Immediately disable the Web UI feature or upgrade to the latest patched Cisco IOS XE software release

[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled and exposed to the internet

[Impact] Unauthenticated remote attackers can bypass authentication to create a local user with Privilege 15 access, subsequently elevating to root to install a persistent malicious implant

[Mitigation] Immediately disable the Web UI (HTTP/HTTPS Server) feature or restrict access to trusted management networks, and upgrade to the recommended fixed software releases

[Affected Scope] Cisco IOS and Cisco IOS XE Software with the Group Encrypted Transport VPN (GET VPN) feature enabled

[Impact] An authenticated, remote attacker with administrative control over a key server or group member can execute arbitrary code or cause a device reload (DoS)

[Mitigation] Apply the official Cisco software updates and restrict GDOI/G-IKEv2 protocol access to authorized infrastructure nodes only

[Affected Scope] Cisco devices running Cisco IOS, IOS XE, or IOS XR Software with Link Layer Discovery Protocol (LLDP) enabled.

[Impact] An unauthenticated, adjacent attacker can send crafted LLDP packets to trigger a denial of service (DoS) or execute arbitrary code with elevated privileges.

[Mitigation] Apply official Cisco software updates immediately, or disable LLDP globally/per-interface as a temporary workaround.

[Affected Scope] Cisco IOS and IOS XE Software with DHCP Option 82 encapsulation functionality enabled

[Impact] An unauthenticated, remote attacker can cause the affected device to reload, resulting in a complete Denial of Service (DoS) condition

[Mitigation] Apply the official software updates from Cisco, or disable DHCP Option 82 / relay features and restrict DHCP traffic using ACLs

[Affected Scope] Cisco devices running Cisco IOS and IOS XE Software with encapsulated DHCPv4 Option 82 restoration enabled

[Impact] An unauthenticated, remote attacker can cause an affected device to reload, resulting in a complete Denial of Service (DoS) condition

[Mitigation] Apply official software updates from Cisco or implement workarounds by hardening DHCP snooping and relay configurations

[Affected Scope] Cisco IOS and IOS XE Software with DHCP Option 82 relay functionality enabled

[Impact] Unauthenticated, remote attackers can trigger a heap overflow and force a device reload, leading to a complete Denial of Service (DoS)

[Mitigation] Apply official Cisco software updates immediately, or disable DHCP Option 82 relay features and restrict untrusted DHCP traffic

[Affected Scope] Cisco network switches and routers running Cisco IOS and IOS XE Software with the Smart Install client feature enabled.

[Impact] Unauthenticated, remote attackers can send crafted packets to TCP port 4786, triggering a heap-based buffer overflow that leads to device reload (DoS) or arbitrary code execution (RCE) with elevated privileges.

[Mitigation] Disable the Smart Install feature using the 'no vstack' command, or restrict access to TCP port 4786 using Infrastructure Access Control Lists (ACLs) if the feature is required.

[Affected Scope] Cisco IOS, IOS XE, and IOS XR Software with Link Layer Discovery Protocol (LLDP) enabled

[Impact] An unauthenticated, adjacent attacker could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) condition

[Mitigation] Apply official Cisco software updates or disable LLDP globally/per-interface as a temporary workaround

[Affected Scope] Cisco IOS and IOS XE Software configured with active Internet Key Exchange Version 1 (IKEv1) functionality.

[Impact] An unauthenticated, remote attacker can cause the affected device to reload by sending crafted IKEv1 packets, resulting in a complete Denial of Service (DoS) condition.

[Mitigation] Apply the official software updates provided by Cisco, or restrict IKEv1 traffic (UDP ports 500 and 4500) to trusted peer IP addresses using Access Control Lists (ACLs).

[Affected Scope] Cisco devices running Cisco IOS or Cisco IOS XE Software with the IKEv2 protocol enabled.

[Impact] An unauthenticated, remote attacker can trigger a continuous memory leak by sending crafted IKEv2 packets, eventually causing a device reload and a complete Denial of Service (DoS) condition.

[Mitigation] Apply the official Cisco software updates or restrict access to IKEv2 ports (UDP 500/4500) using Infrastructure Access Control Lists (iACLs).

[Affected Scope] Cisco switches running Cisco IOS or IOS XE Software with the Smart Install client feature enabled

[Impact] Unauthenticated, remote attackers can trigger an unexpected device reload, leading to a persistent Denial of Service (DoS) condition

[Mitigation] Disable the Smart Install feature using the 'no vstack' command, or restrict access to TCP port 4786 using infrastructure ACLs

[Affected Scope] Cisco IOS and IOS XE Software with the Quality of Service (QoS) subsystem enabled and listening on UDP port 18999.

[Impact] An unauthenticated, remote attacker can execute arbitrary code with elevated privileges or cause a denial of service (DoS) condition via device reload.

[Mitigation] Apply official Cisco software updates, or restrict access to UDP port 18999 using Infrastructure Access Control Lists (iACLs).

[Affected Scope] Cisco IOS XE Software releases prior to 16.3 with BGP EVPN configuration enabled

[Impact] Unauthenticated, remote attackers can trigger a device reload or corrupt the BGP routing table, leading to a complete Denial of Service (DoS) and network instability

[Mitigation] Upgrade to Cisco IOS XE Software release 16.3 or later, or disable EVPN configurations if not business-critical

[Affected Scope] Cisco network devices running Cisco IOS Software versions 12.2 through 15.6 or Cisco IOS XE Software with the DHCP relay subsystem enabled.

[Impact] An unauthenticated, remote attacker can execute arbitrary code with full system privileges (RCE) or trigger a system reload, causing a complete Denial of Service (DoS).

[Mitigation] Apply the official Cisco software updates immediately, or implement access control lists (ACLs) to block unauthorized DHCPv4 traffic and disable DHCP relay where not required.

[Affected Scope] Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 with ISAKMP enabled

[Impact] Unauthenticated, remote attackers can trigger high CPU utilization, traceback messages, or device reloads (DoS) by sending crafted IKEv2 packets

[Mitigation] Apply official Cisco software patches immediately, or restrict UDP 500/4500 traffic at the network boundary using Infrastructure ACLs (iACLs).

[Affected Scope] Cisco IOS 15.1, 15.2, 15.4 and IOS XE versions 3.14 through 3.18.

[Impact] An unauthenticated, remote attacker can send UDP packets with a destination port of 0 to cause an interface queue wedge, leading to a complete Denial of Service (DoS) condition.

[Mitigation] Upgrade to the latest recommended Cisco IOS/IOS XE software releases, or implement Infrastructure Access Control Lists (iACLs) to drop UDP packets targeting destination port 0.

[Affected Scope] Cisco network devices running Cisco IOS or IOS XE Software with the Autonomic Networking feature enabled (specifically Denali-16.2.1, Denali-16.3.1)

[Impact] An unauthenticated, adjacent attacker can cause affected autonomic nodes to reload, leading to a complete Denial of Service (DoS) condition

[Mitigation] Apply official Cisco software updates or disable the Autonomic Networking Infrastructure (ANI) feature if not required

[Affected Scope] Cisco IOS and IOS XE Software with SNMP enabled and affected MIBs/OIDs not explicitly excluded

[Impact] An authenticated, remote attacker can execute arbitrary code with full system control or cause a denial of service (system reload)

[Mitigation] Apply official Cisco software updates, or implement workarounds by restricting SNMP views to exclude vulnerable MIBs and enforcing ACLs