CVE Vulnerability Advisory Database

[Affected Scope] All versions of Cisco IOS and Cisco IOS XE Software with active SNMP services

[Impact] Authenticated attackers can trigger a system reload (DoS) or execute arbitrary code with root privileges (RCE) via crafted SNMP packets

[Mitigation] Apply official Cisco software updates immediately, restrict SNMP access via ACLs, or disable unused SNMP services

[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled on network devices

[Impact] An authenticated, remote attacker can exploit insufficient input validation to inject arbitrary commands into the underlying operating system with root privileges, leading to complete system compromise

[Mitigation] Immediately disable the Web UI feature or upgrade to the latest patched Cisco IOS XE software release

[Affected Scope] Cisco IOS XE Software with the Web UI feature enabled and exposed to the internet

[Impact] Unauthenticated remote attackers can bypass authentication to create a local user with Privilege 15 access, subsequently elevating to root to install a persistent malicious implant

[Mitigation] Immediately disable the Web UI (HTTP/HTTPS Server) feature or restrict access to trusted management networks, and upgrade to the recommended fixed software releases

[Affected Scope] Cisco IOS and Cisco IOS XE Software with the Group Encrypted Transport VPN (GET VPN) feature enabled

[Impact] An authenticated, remote attacker with administrative control over a key server or group member can execute arbitrary code or cause a device reload (DoS)

[Mitigation] Apply the official Cisco software updates and restrict GDOI/G-IKEv2 protocol access to authorized infrastructure nodes only