alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2020-3374 (published 2020-07-31)
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The vulnerability is due to insufficient authorization checking on the affected system. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to gain privileges beyond what would normally be authorized for their configured user authorization level. The attacker may be able to access sensitive information, modify the system configuration, or impact the availability of the affected system.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-285
Affected vendors: cisco
Affected products: sd-wan
CVE-2020-3375 (published 2020-07-31)
A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to information that they are not authorized to access, make changes to the system that they are not authorized to make, and execute commands on an affected system with privileges of the root user.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: cisco
Affected products: ios_xe_sd-wan, sd-wan
CVE-2020-3376 (published 2020-07-31)
A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions on an affected device. The vulnerability is due to a failure in the software to perform proper authentication. An attacker could exploit this vulnerability by browsing to one of the hosted URLs in Cisco DCNM. A successful exploit could allow the attacker to interact with and use certain functions within the Cisco DCNM.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: cisco
Affected products: data_center_network_manager
CVE-2020-3377 (published 2020-07-31)
A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary commands on the affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted arguments to a specific field within the application. A successful exploit could allow the attacker to run commands as the administrator on the DCNM.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: cisco
Affected products: data_center_network_manager
CVE-2020-3378 (published 2020-07-16)
A vulnerability in the web-based management interface for Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input that includes SQL statements to an affected system. A successful exploit could allow the attacker to modify entries in some database tables, affecting the integrity of the data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-89
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-6g_integrated_services_router, sd-wan_firmware, vedge_100, vedge_1000, vedge_100b, vedge_100m, vedge_100wm, vedge_2000, vedge_5000
CVE-2020-3379 (published 2020-07-16)
A vulnerability in Cisco SD-WAN Solution Software could allow an authenticated, local attacker to elevate privileges to Administrator on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain administrative privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: cisco
Affected products: sd-wan_firmware, vbond_orchestrator, vedge_100, vedge_1000, vedge_100b, vedge_100m, vedge_100wm, vedge_2000, vedge_5000, vsmart_controller
CVE-2020-3380 (published 2020-07-16)
A vulnerability in the CLI of Cisco Data Center Network Manager (DCNM) could allow an authenticated, local attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by authenticating as the fmserver user and submitting malicious input to a specific command. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-88
Affected vendors: cisco
Affected products: data_center_network_manager
CVE-2020-3381 (published 2020-07-16)
A vulnerability in the web management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct directory traversal attacks and obtain read and write access to sensitive files on a targeted system. The vulnerability is due to a lack of proper validation of files that are uploaded to an affected device. An attacker could exploit this vulnerability by uploading a crafted file to an affected system. An exploit could allow the attacker to view or modify arbitrary files on the targeted system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-6g_integrated_services_router, sd-wan_firmware
CVE-2020-3382 (published 2020-07-31)
A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability exists because different installations share a static encryption key. An attacker could exploit this vulnerability by using the static key to craft a valid session token. A successful exploit could allow the attacker to perform arbitrary actions through the REST API with administrative privileges.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: cisco
Affected products: data_center_network_manager
CVE-2020-3383 (published 2020-07-31)
A vulnerability in the archive utility of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to a lack of proper input validation of paths that are embedded within archive files. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to write arbitrary files in the system with the privileges of the logged-in user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cisco
Affected products: data_center_network_manager
CVE-2020-3384 (published 2020-07-31)
A vulnerability in specific REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system with the privileges of the logged-in user. The vulnerability is due to insufficient validation of user-supplied input to the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to inject arbitrary commands on the underlying operating system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L)
Weakness: CWE-184
Affected vendors: cisco
Affected products: data_center_network_manager
CVE-2020-3385 (published 2020-07-16)
A vulnerability in the deep packet inspection (DPI) engine of Cisco SD-WAN vEdge Routers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient handling of malformed packets. An attacker could exploit this vulnerability by sending crafted packets through an affected device. A successful exploit could allow the attacker to cause the device to reboot, resulting in a DoS condition.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-371
Affected vendors: cisco
Affected products: sd-wan_firmware, vedge_5000, vedge_cloud_router
CVE-2020-3386 (published 2020-07-31)
A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with a low-privileged account to bypass authorization on the API of an affected device. The vulnerability is due to insufficient authorization of certain API functions. An attacker could exploit this vulnerability by sending a crafted request to the API using low-privileged credentials. A successful exploit could allow the attacker to perform arbitrary actions through the REST API with administrative privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-285
Affected vendors: cisco
Affected products: data_center_network_manager
CVE-2020-3387 (published 2020-07-16)
A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute code with root privileges on an affected system. The vulnerability is due to insufficient input sanitization during user authentication processing. An attacker could exploit this vulnerability by sending a crafted response to the Cisco SD-WAN vManage Software. A successful exploit could allow the attacker to access the software and execute commands they should not be authorized to execute.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-6g_integrated_services_router, sd-wan_firmware
CVE-2020-3388 (published 2020-07-16)
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated to access the CLI. A successful exploit could allow the attacker to execute commands with root privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-6g_integrated_services_router, sd-wan_firmware
CVE-2020-3389 (published 2020-08-26)
A vulnerability in the installation component of Cisco Hyperflex HX-Series Software could allow an authenticated, local attacker to retrieve the password that was configured at installation on an affected device. The vulnerability exists because sensitive information is stored as clear text. An attacker could exploit this vulnerability by authenticating to an affected device and navigating to the directory that contains sensitive information. A successful exploit could allow the attacker to obtain sensitive information in clear text from the affected device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-310
Affected vendors: cisco
Affected products: hyperflex_hx-series_software
CVE-2020-3390 (published 2020-09-24)
A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of the Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause the device to unexpectedly reload, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to the lack of input validation of the information used to generate an SNMP trap in relation to a wireless client connection. An attacker could exploit this vulnerability by sending an 802.1x packet with crafted parameters during the wireless authentication setup phase of a connection. A successful exploit could allow the attacker to cause the device to reload, causing a DoS condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: cisco
Affected products: catalyst_9800-40, catalyst_9800-80, catalyst_9800-cl, catalyst_9800-l, catalyst_9800-l-c, catalyst_9800-l-f, ios_xe
CVE-2020-3391 (published 2020-07-02)
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensitive information in clear text. The vulnerability is due to insecure storage of certain unencrypted credentials on an affected device. An attacker could exploit this vulnerability by viewing the network device configuration and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to discover and manage network devices.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: digital_network_architecture_center
CVE-2020-3392 (published 2020-11-18)
A vulnerability in the API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not properly authenticate API calls. An attacker could exploit this vulnerability by sending API requests to an affected system. A successful exploit could allow the attacker to view sensitive information on the affected system, including information about the devices that the system manages, without authentication.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: cisco
Affected products: iot_field_network_director
CVE-2020-3393 (published 2020-09-24)
A vulnerability in the application-hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. The attacker could execute IOS XE commands outside the application-hosting subsystem Docker container as well as on the underlying Linux operating system. These commands could be run as the root user. The vulnerability is due to a combination of two factors: (a) incomplete input validation of the user payload of CLI commands, and (b) improper role-based access control (RBAC) when commands are issued at the command line within the application-hosting subsystem. An attacker could exploit this vulnerability by using a CLI command with crafted user input. A successful exploit could allow the lower-privileged attacker to execute arbitrary CLI commands with root privileges. The attacker would need valid user credentials to exploit this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-4p_integrated_services_router, 1100-6g_integrated_services_router, 1100-8p_integrated_services_router, 1100-lte_integrated_services_router, 1100_integrated_services_router, 1101-4p_integrated_services_router, 1101_integrated_services_router, 1109-2p_integrated_services_router, 1109-4p_integrated_services_router, 1109_integrated_services_router, 1111x-8p_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4221_integrated_services_router, 4331_integrated_services_router, 4431_integrated_services_router, 4451_integrated_services_router, 4461_integrated_services_router, asr1001-hx, asr1001-hx-rf
CVE-2020-3394 (published 2020-08-27)
A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to issue the enable command and get full administrative privileges. To exploit this vulnerability, the attacker would need to have valid credentials for the affected device. The vulnerability is due to a logic error in the implementation of the enable command. An attacker could exploit this vulnerability by logging in to the device and issuing the enable command. A successful exploit could allow the attacker to gain full administrative privileges without using the enable password. Note: The Enable Secret feature is disabled by default.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-285
Affected vendors: cisco
Affected products: nexus_3016, nexus_3048, nexus_3064, nexus_3064-t, nexus_31108pc-v, nexus_31108tc-v, nexus_31128pq, nexus_3132c-z, nexus_3132q, nexus_3132q-v, nexus_3132q-xl, nexus_3164q, nexus_3172, nexus_3172pq-xl, nexus_3172tq, nexus_3172tq-32t, nexus_3172tq-xl, nexus_3232c, nexus_3264c-e, nexus_3264q, nexus_3408-s, nexus_34180yc, nexus_3432d-s, nexus_3464c, nexus_3524
CVE-2020-3396 (published 2020-09-24)
A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0 SSD and modify sensitive areas of the file system, including the namespace container protections. The vulnerability occurs because the USB 3.0 SSD control data is not stored on the internal boot flash. An attacker could exploit this vulnerability by removing the USB 3.0 SSD, modifying or deleting files on the USB 3.0 SSD by using another device, and then reinserting the USB 3.0 SSD on the original device. A successful exploit could allow the attacker to remove container protections and perform file actions outside the namespace of the container with root privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-6g_integrated_services_router, 1100-lte_integrated_services_router, 1100_integrated_services_router, 4321\/k9-rf_integrated_services_router, 4321\/k9-ws_integrated_services_router, 4321\/k9_integrated_services_router, 4331\/k9-rf_integrated_services_router, 4331\/k9-ws_integrated_services_router, 4331\/k9_integrated_services_router, 4351\/k9-rf_integrated_services_router, 4351\/k9-ws_integrated_services_router, 4351\/k9_integrated_services_router, asr_1000-x, asr_1001, asr_1001-x, asr_1002, asr_1002-x, asr_1004, asr_1006, asr_1013, asr_1023, catalyst_c9300-24p
CVE-2020-3397 (published 2020-08-27)
A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of a specific type of BGP MVPN update message. An attacker could exploit this vulnerability by sending this specific, valid BGP MVPN update message to a targeted device. A successful exploit could allow the attacker to cause one of the BGP-related routing applications to restart multiple times, leading to a system-level restart. Note: The Cisco implementation of BGP accepts incoming BGP traffic from only explicitly configured peers. To exploit this vulnerability, an attacker must send a specific BGP MVPN update message over an established TCP connection that appears to come from a trusted BGP peer. To do so, the attacker must obtain information about the BGP peers in the trusted network of the affected system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: cisco
Affected products: nexus_3016, nexus_3048, nexus_3064, nexus_3064-t, nexus_31108pc-v, nexus_31108tc-v, nexus_31128pq, nexus_3132c-z, nexus_3132q, nexus_3132q-v, nexus_3132q-xl, nexus_3164q, nexus_3172, nexus_3172pq-xl, nexus_3172tq, nexus_3172tq-32t, nexus_3172tq-xl, nexus_3232c, nexus_3264c-e, nexus_3264q, nexus_3408-s, nexus_34180yc, nexus_3432d-s, nexus_3464c, nexus_3524
CVE-2020-3398 (published 2020-08-27)
A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a BGP session to repeatedly reset, causing a partial denial of service (DoS) condition due to the BGP session being down. The vulnerability is due to incorrect parsing of a specific type of BGP MVPN update message. An attacker could exploit this vulnerability by sending this BGP MVPN update message to a targeted device. A successful exploit could allow the attacker to cause the BGP peer connections to reset, which could lead to BGP route instability and impact traffic. The incoming BGP MVPN update message is valid but is parsed incorrectly by the NX-OS device, which could send a corrupted BGP update to the configured BGP peer. Note: The Cisco implementation of BGP accepts incoming BGP traffic from only explicitly configured peers. To exploit this vulnerability, an attacker must send a specific BGP MVPN update message over an established TCP connection that appears to come from a trusted BGP peer. To do so, the attacker must obtain information about the BGP peers in the trusted network of the affected system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: cisco
Affected products: nexus_3016, nexus_3048, nexus_3064, nexus_3064-t, nexus_31108pc-v, nexus_31108tc-v, nexus_31128pq, nexus_3132c-z, nexus_3132q, nexus_3132q-v, nexus_3132q-xl, nexus_3164q, nexus_3172, nexus_3172pq-xl, nexus_3172tq, nexus_3172tq-32t, nexus_3172tq-xl, nexus_3232c, nexus_3264c-e, nexus_3264q, nexus_3408-s, nexus_34180yc, nexus_3432d-s, nexus_3464c, nexus_3524
CVE-2020-3399 (published 2020-09-24)
A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition of an affected device. The vulnerability is due to insufficient input validation during CAPWAP packet processing. An attacker could exploit this vulnerability by sending a crafted CAPWAP packet to an affected device, resulting in a buffer over-read. A successful exploit could allow the attacker to cause the affected device to crash and reload, resulting in a DoS condition on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: cisco
Affected products: catalyst_9800-40, catalyst_9800-80, catalyst_9800-cl, catalyst_9800-l, catalyst_9800-l-c, catalyst_9800-l-f, ios_xe
CVE-2020-3400 (published 2020-09-24)
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to utilize parts of the web UI for which they are not authorized.The vulnerability is due to insufficient authorization of web UI access requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web UI. A successful exploit could allow the attacker to utilize parts of the web UI for which they are not authorized. This could allow a Read-Only user to perform actions of an Admin user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: cisco
Affected products: ios_xe
CVE-2020-3401 (published 2020-07-16)
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to the affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-6g_integrated_services_router, sd-wan_firmware, vedge_100, vedge_1000, vedge_100b, vedge_100m, vedge_100wm, vedge_2000, vedge_5000
CVE-2020-3402 (published 2020-07-02)
A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because certain RMI listeners are not properly authenticated. An attacker could exploit this vulnerability by sending a crafted request to the affected listener. A successful exploit could allow the attacker to access sensitive information on an affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: cisco
Affected products: unified_customer_voice_portal
CVE-2020-3403 (published 2020-09-24)
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to inject a command to the underlying operating system that will execute with root privileges upon the next reboot of the device. The authenticated user must have privileged EXEC permissions on the device. The vulnerability is due to insufficient protection of values passed to a script that executes during device startup. An attacker could exploit this vulnerability by writing values to a specific file. A successful exploit could allow the attacker to execute commands with root privileges each time the affected device is restarted.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: cisco
Affected products: catalyst_9800-40, catalyst_9800-80, catalyst_9800-cl, catalyst_9800-l, catalyst_9800-l-c, catalyst_9800-l-f, ios_xe
CVE-2020-3404 (published 2020-09-24)
A vulnerability in the persistent Telnet/Secure Shell (SSH) CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS) with root privileges. The vulnerability is due to insufficient enforcement of the consent token in authorizing shell access. An attacker could exploit this vulnerability by authenticating to the persistent Telnet/SSH CLI on an affected device and requesting shell access. A successful exploit could allow the attacker to gain shell access on the affected device and execute commands on the underlying OS with root privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-863
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-4p_integrated_services_router, 1100-6g_integrated_services_router, 1100-8p_integrated_services_router, 1100-lte_integrated_services_router, 1100_integrated_services_router, 1101-4p_integrated_services_router, 1101_integrated_services_router, 1109-2p_integrated_services_router, 1109-4p_integrated_services_router, 1109_integrated_services_router, 1111x-8p_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4221_integrated_services_router, 4331_integrated_services_router, 4431_integrated_services_router, 4451_integrated_services_router, 4461_integrated_services_router, asr1001-hx, asr1001-hx-rf
CVE-2020-3405 (published 2020-07-16)
A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files within the affected application.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)
Weakness: CWE-611
Affected vendors: cisco
Affected products: sd-wan_firmware
CVE-2020-3406 (published 2020-07-16)
A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: sd-wan_firmware
CVE-2020-3407 (published 2020-09-24)
A vulnerability in the RESTCONF and NETCONF-YANG access control list (ACL) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of the ACL that is tied to the RESTCONF or NETCONF-YANG feature. An attacker could exploit this vulnerability by accessing the device using RESTCONF or NETCONF-YANG. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-4p_integrated_services_router, 1100-6g_integrated_services_router, 1100-8p_integrated_services_router, 1100-lte_integrated_services_router, 1100_integrated_services_router, 1101-4p_integrated_services_router, 1101_integrated_services_router, 1109-2p_integrated_services_router, 1109-4p_integrated_services_router, 1109_integrated_services_router, 1111x-8p_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4221_integrated_services_router, 4331_integrated_services_router, 4431_integrated_services_router, 4451_integrated_services_router, 4461_integrated_services_router, asr1001-hx, asr1001-hx-rf
CVE-2020-3408 (published 2020-09-24)
A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability occurs because the regular expression (regex) engine that is used with the Split DNS feature of affected releases may time out when it processes the DNS name list configuration. An attacker could exploit this vulnerability by trying to resolve an address or hostname that the affected device handles. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-185
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-4p_integrated_services_router, 1100-6g_integrated_services_router, 1100-8p_integrated_services_router, 1100-lte_integrated_services_router, 1100_integrated_services_router, 1101-4p_integrated_services_router, 1101_integrated_services_router, 1109-2p_integrated_services_router, 1109-4p_integrated_services_router, 1109_integrated_services_router, 1111x-8p_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4221_integrated_services_router, 4331_integrated_services_router, 4431_integrated_services_router, 4451_integrated_services_router, 4461_integrated_services_router, asr1001-hx, asr1001-hx-rf
CVE-2020-3409 (published 2020-09-24)
A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ie-3200-8p2s-e, ie-3200-8t2s-e, ie-3300-8p2s-a, ie-3300-8p2s-e, ie-3300-8t2s-a, ie-3300-8t2s-e, ie-3300-8t2x-a, ie-3300-8t2x-e, ie-3400-8p2s-a, ie-3400-8p2s-e, ie-3400-8t2s-e, ie-4000-16gt4g-e, ie-4000-16t4g-e, ie-4000-4gc4gp4g-e, ie-4000-4gs8gp4g-e, ie-4000-4s8p4g-e, ie-4000-4t4p4g-e, ie-4000-4tc4g-e, ie-4000-8gs4g-e, ie-4000-8gt4g-e, ie-4000-8gt8gp4g-e, ie-4000-8s4g-e, ie-4000-8t4g-e, iem-3300-14t2s, iem-3300-16p
CVE-2020-3410 (published 2020-10-21)
A vulnerability in the Common Access Card (CAC) authentication feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and access the FMC system. The attacker must have a valid CAC to initiate the access attempt. The vulnerability is due to incorrect session invalidation during CAC authentication. An attacker could exploit this vulnerability by performing a CAC-based authentication attempt to an affected system. A successful exploit could allow the attacker to access an affected system with the privileges of a CAC-authenticated user who is currently logged in.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: cisco
Affected products: secure_firewall_management_center
CVE-2020-3411 (published 2020-08-17)
A vulnerability in Cisco DNA Center software could allow an unauthenticated remote attacker access to sensitive information on an affected system. The vulnerability is due to improper handling of authentication tokens by the affected software. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker access to sensitive device information, which includes configuration files.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: catalyst_center
CVE-2020-3412 (published 2020-08-17)
A vulnerability in the scheduled meeting template feature of Cisco Webex Meetings could allow an authenticated, remote attacker to create a scheduled meeting template that would belong to another user in their organization. The vulnerability is due to insufficient authorization enforcement for the creation of scheduled meeting templates. An attacker could exploit this vulnerability by sending a crafted request to the Webex Meetings interface to create a scheduled meeting template. A successful exploit could allow the attacker to create a scheduled meeting template that would belong to a user other than themselves.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-284
Affected vendors: cisco
Affected products: webex_meetings_online
CVE-2020-3413 (published 2020-08-17)
A vulnerability in the scheduled meeting template feature of Cisco Webex Meetings could allow an authenticated, remote attacker to delete a scheduled meeting template that belongs to another user in their organization. The vulnerability is due to insufficient authorization enforcement for requests to delete scheduled meeting templates. An attacker could exploit this vulnerability by sending a crafted request to the Webex Meetings interface to delete a scheduled meeting template. A successful exploit could allow the attacker to delete a scheduled meeting template that belongs to a user other than themselves.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-284
Affected vendors: cisco
Affected products: webex_meetings_online
CVE-2020-3414 (published 2020-09-24)
A vulnerability in the packet processing of Cisco IOS XE Software for Cisco 4461 Integrated Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect processing of IPv4 or IPv6 traffic to or through an affected device. An attacker could exploit this vulnerability by sending IP traffic to or through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-19
Affected vendors: cisco
Affected products: 4461_integrated_services_router, ios_xe
CVE-2020-3415 (published 2020-08-27)
A vulnerability in the Data Management Engine (DME) of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent affected device. A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the Cisco Discovery Protocol process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Exploitation of this vulnerability also requires jumbo frames to be enabled on the interface that receives the crafted Cisco Discovery Protocol packets on the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: cisco
Affected products: nexus_3016, nexus_3048, nexus_3064, nexus_3064-t, nexus_31108pc-v, nexus_31108tc-v, nexus_31128pq, nexus_3132c-z, nexus_3132q, nexus_3132q-v, nexus_3132q-xl, nexus_3164q, nexus_3172, nexus_3172pq-xl, nexus_3172tq, nexus_3172tq-32t, nexus_3172tq-xl, nexus_3232c, nexus_3264c-e, nexus_3264q, nexus_3408-s, nexus_34180yc, nexus_3432d-s, nexus_3464c, nexus_3524
CVE-2020-3416 (published 2020-09-24)
Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services Routers with a Route Switch Processor 3 (RSP3) installed could allow an authenticated, local attacker with high privileges to execute persistent code at bootup and break the chain of trust. These vulnerabilities are due to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set. An attacker could exploit these vulnerabilities by copying a specific file to the local file system of an affected device and defining specific ROMMON variables. A successful exploit could allow the attacker to run arbitrary code on the underlying operating system (OS) with root privileges. To exploit these vulnerabilities, an attacker would need to have access to the root shell on the device or have physical access to the device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-749
Affected vendors: cisco
Affected products: asr_902, asr_903, asr_907, ios_xe
CVE-2020-3417 (published 2020-09-24)
A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to execute persistent code at boot time and break the chain of trust. This vulnerability is due to incorrect validations by boot scripts when specific ROM monitor (ROMMON) variables are set. An attacker could exploit this vulnerability by installing code to a specific directory in the underlying operating system (OS) and setting a specific ROMMON variable. A successful exploit could allow the attacker to execute persistent code on the underlying OS. To exploit this vulnerability, the attacker would need access to the root shell on the device or have physical access to the device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: cisco
Affected products: ios_xe
CVE-2020-3418 (published 2020-09-24)
A vulnerability in Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9800 Series Routers could allow an unauthenticated, adjacent attacker to send ICMPv6 traffic prior to the client being placed into RUN state. The vulnerability is due to an incomplete access control list (ACL) being applied prior to RUN state. An attacker could exploit this vulnerability by connecting to the associated service set identifier (SSID) and sending ICMPv6 traffic. A successful exploit could allow the attacker to send ICMPv6 traffic prior to RUN state.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
Weakness: CWE-284
Affected vendors: cisco
Affected products: catalyst_9800-40, catalyst_9800-80, catalyst_9800-cl, catalyst_9800-l, catalyst_9800-l-c, catalyst_9800-l-f, ios_xe
CVE-2020-3419 (published 2020-11-18)
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearing on the participant list. This vulnerability is due to improper handling of authentication tokens by a vulnerable Webex site. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Cisco Webex Meetings Server site. A successful exploit requires the attacker to have access to join a Webex meeting, including applicable meeting join links and passwords. The attacker could then exploit this vulnerability to join meetings, without appearing in the participant list, while having full access to audio, video, chat, and screen sharing capabilities.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-913
Affected vendors: cisco
Affected products: webex_meetings_server
CVE-2020-3420 (published 2024-11-18)
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.There are no workarounds that address this vulnerability.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: unified_communications_manager
CVE-2020-3421 (published 2020-09-24)
Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the device. An attacker could exploit these vulnerabilities by sending a certain sequence of traffic patterns through the device. A successful exploit could allow the attacker to cause the device to reload or stop forwarding traffic through the firewall, resulting in a denial of service. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: cisco
Affected products: 1100_integrated_services_router, 1101_integrated_services_router, 1109_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4221_integrated_services_router, 4321_integrated_services_router, 4331_integrated_services_router, 4351_integrated_services_router, 4431_integrated_services_router, 4461_integrated_services_router, asr_1001-hx, asr_1001-x, asr_1002-hx, asr_1002-x, asr_1004, asr_1006, asr_1006-x, asr_1009-x, asr_1013, csr_1000v, ios_xe
CVE-2020-3422 (published 2020-09-24)
A vulnerability in the IP Service Level Agreement (SLA) responder feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the IP SLA responder to reuse an existing port, resulting in a denial of service (DoS) condition. The vulnerability exists because the IP SLA responder could consume a port that could be used by another feature. An attacker could exploit this vulnerability by sending specific IP SLA control packets to the IP SLA responder on an affected device. The control packets must include the port number that could be used by another configured feature. A successful exploit could allow the attacker to cause an in-use port to be consumed by the IP SLA responder, impacting the feature that was using the port and resulting in a DoS condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-371
Affected vendors: cisco
Affected products: 1100_integrated_services_router, 1101_integrated_services_router, 1109_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4221_integrated_services_router, 4331_integrated_services_router, 4431_integrated_services_router, 4461_integrated_services_router, asr_1001-hx, asr_1001-x, asr_1002-hx, asr_1002-x, asr_1004, asr_1006, asr_1006-x, asr_1009-x, asr_1013, catalyst_3650, catalyst_3850, catalyst_9200, catalyst_9300, catalyst_9400