CVE-2023-20254 is a high-severity vulnerability in Cisco SD-WAN vManage affecting its multi-tenant session management. An authenticated remote attacker with access to the system can exploit insufficient session management to access or manipulate another tenant's data and configurations. Exploitation requires the multi-tenant feature to be enabled and does not require user interaction but does require authentication. Successful exploitation can lead to unauthorized data disclosure, configuration changes, or denial of service for affected tenants. The vulnerability affects numerous versions of Cisco SD-WAN vManage, spanning multiple major releases. No known exploits are currently reported in the wild. The CVSS score is 7.2, reflecting high impact on confidentiality, integrity, and availability with relatively low attack complexity. European organizations using Cisco SD-WAN with multi-tenant setups should prioritize patching or mitigating this vulnerability to prevent cross-tenant compromise and service disruption.
CVE-2023-20236 is a vulnerability in Cisco IOS XR software's iPXE boot function that allows an authenticated local attacker to bypass cryptographic signature verification and install an unverified software image. Exploitation requires local access with high privileges and no user interaction. Successful exploitation can compromise confidentiality, integrity, and availability by booting malicious firmware. The vulnerability affects numerous IOS XR versions widely used in network infrastructure. While no known exploits are reported in the wild, the medium CVSS score reflects the significant impact but limited attack vector. European organizations relying on Cisco IOS XR for critical routing and network functions are at risk, especially in countries with high Cisco market penetration and critical telecom infrastructure. Mitigation involves applying vendor patches once available, restricting local access, and monitoring boot configurations. Countries like Germany, France, UK, Italy, and the Netherlands are most likely affected due to their extensive Cisco deployments and strategic network importance.
CVE-2023-20135 is a medium-severity vulnerability in Cisco IOS XR Software that involves improper verification of cryptographic signatures due to a TOCTOU race condition during ISO image installation. An authenticated local attacker with high privileges can exploit this flaw by modifying an ISO image and performing parallel install requests, potentially leading to arbitrary code execution on the device. The vulnerability affects multiple IOS XR versions including 7.5.x through 7.9.x. Exploitation does not require user interaction but does require local authentication and high privileges. No known exploits are currently reported in the wild. This vulnerability poses a significant risk to network infrastructure devices running affected IOS XR versions, especially in environments where local access is possible.
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.
This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following:
Identify valid credentials that could then be used to establish an unauthorized remote access VPN session.
Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier).
Notes:
Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured.
This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured.
Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.
CVE-2023-20238 is a critical vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Xtended Services Platform. It allows an unauthenticated remote attacker to forge SSO tokens and gain unauthorized access to affected systems. Exploitation requires knowledge of a valid user ID but no authentication or user interaction is needed. Successful exploitation can lead to toll fraud, command execution with the privileges of the forged account, and if an administrator account is forged, full control over confidential data and system settings. The vulnerability affects multiple versions of Cisco BroadWorks, including versions 21.sp1 through 23.0 with numerous patches. The CVSS score is 10.0, indicating critical severity with network attack vector, low complexity, no privileges required, and no user interaction. There are no known exploits in the wild yet.
CVE-2023-20250 is a stack-based buffer overflow vulnerability in the web-based management interface of Cisco Small Business RV Series routers, including models RV110W, RV130, RV130W, and RV215W. An authenticated attacker with valid administrator credentials can exploit this flaw by sending crafted requests to the interface, resulting in arbitrary code execution with root privileges. The vulnerability affects multiple firmware versions and does not require user interaction beyond authentication. Although the CVSS score is 6.5 (medium severity), the impact on confidentiality and integrity is high due to root-level code execution. No known exploits are currently reported in the wild. European organizations using these routers should prioritize patching and restrict administrative access to mitigate risk. Countries with significant Cisco Small Business router deployments and critical infrastructure reliance on these devices are more likely to be impacted.
CVE-2023-20209 is a medium severity vulnerability in Cisco TelePresence Video Communication Server (VCS) Expressway's web-based management interface. It allows an authenticated attacker with read-write privileges to perform command injection, potentially leading to remote code execution with root privileges. Exploitation requires no user interaction but does require high-level privileges on the device. The vulnerability stems from insufficient input validation in the management interface. Although no known exploits are currently in the wild, successful exploitation could severely compromise affected systems. The vulnerability affects numerous versions of Cisco VCS Expressway, widely used in enterprise video communication. European organizations using these products are at risk, especially those with critical video conferencing infrastructure. Mitigation involves applying vendor patches once available, restricting access to management interfaces, and monitoring for suspicious activity. Countries with high Cisco market penetration and strategic reliance on video communications, such as Germany, France, UK, and the Netherlands, are most likely to be impacted.
CVE-2004-1464 is a denial-of-service vulnerability in Cisco IOS that can block telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and sometimes HTTP access to affected devices. This vulnerability has been exploited in the wild and poses a high risk of service disruption.
CVE-2016-6415 is an information disclosure vulnerability in Cisco IOS, IOS XR, and IOS XE affecting the Internet Key Exchange version 1 (IKEv1) security negotiation process. The vulnerability arises from insufficient condition checks in the code handling IKEv1 requests, allowing an attacker to retrieve memory contents. This could lead to unauthorized disclosure of sensitive information. The vulnerability has been exploited in the wild. No explicit patch information is provided in the input data.
CVE-2017-6742 is a high-severity vulnerability in the SNMP subsystem of Cisco IOS and IOS XE software. It allows an authenticated remote attacker to execute arbitrary code or cause the affected system to reload. This vulnerability has been exploited in the wild. No explicit affected versions or patch information is provided in the input data.
CVE-2020-3433 is a DLL hijacking vulnerability in Cisco AnyConnect Secure Mobility Client for Windows. The vulnerability arises from insufficient validation of resources loaded at runtime via the interprocess communication channel. An attacker with valid Windows credentials could exploit this flaw to execute code with SYSTEM privileges on the affected machine. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
CVE-2020-3153 is a vulnerability in Cisco AnyConnect Secure Mobility Client for Windows involving improper handling of directory paths. An attacker with valid Windows credentials can exploit this flaw to copy malicious files to arbitrary locations with system-level privileges, enabling attacks such as DLL pre-loading and DLL hijacking. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
CVE-2019-15271 is a deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers. This flaw could allow an attacker to execute code with root privileges on affected devices. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
CVE-2016-6367 is a high-severity vulnerability in the command-line interface (CLI) parser of Cisco Adaptive Security Appliance (ASA) software. It allows an authenticated local attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.
CVE-2016-6366 is a high-severity buffer overflow vulnerability in the SNMP code of Cisco Adaptive Security Appliance (ASA) software. Exploitation of this flaw could allow an attacker to cause the affected device to reload or execute arbitrary code remotely. This vulnerability has been observed exploited in the wild. No specific affected versions or patch information is provided in the input data.
Cisco IOS XR software activates a health check feature that opens TCP port 6379 by default. This port exposes a Redis instance running within the NOSi container, which an attacker can connect to and potentially access. The vulnerability is known as CVE-2022-20821 and has been exploited in the wild. No specific affected versions or patch information are provided.
CVE-2018-0125 is a high-severity vulnerability in the web interface of Cisco VPN Routers that allows an unauthenticated remote attacker to execute arbitrary code with root privileges, potentially gaining full control of the affected system. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2018-0147 is a high-severity vulnerability in Cisco Secure Access Control System (ACS) involving insecure Java deserialization. This flaw allows an unauthenticated remote attacker to execute arbitrary commands on affected devices by exploiting unsafe deserialization of user-supplied data. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2015-0666 is a directory traversal vulnerability in the fmserver servlet of Cisco Prime Data Center Network Manager (DCNM) that allows remote attackers to read arbitrary files on the affected system. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2017-3881 is a high-severity vulnerability in Cisco IOS and IOS XE software affecting the Cisco Cluster Management Protocol (CMP) processing code. It allows an unauthenticated remote attacker to cause a device reload or execute code with elevated privileges. This vulnerability has been exploited in the wild.
