alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-34691 (published 2021-07-15)
iDrive RemotePC before 4.0.1 on Linux allows denial of service. A remote and unauthenticated attacker can disconnect a valid user session by connecting to an ephemeral port.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: idrive, linux
Affected products: linux_kernel, remotepc
CVE-2021-34692 (published 2021-07-15)
iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged user can force RemotePC to execute an attacker-controlled executable with SYSTEM privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-829
Affected vendors: idrive, microsoft
Affected products: remotepc, windows
CVE-2021-34693 (published 2021-06-14)
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-909
Affected vendors: debian, linux
Affected products: debian_linux, linux_kernel
CVE-2021-34696 (published 2021-09-23)
A vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to incorrect programming of hardware when an ACL is configured using a method other than the configuration CLI. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
Weakness: CWE-284
Affected vendors: cisco
Affected products: asr_902, asr_903, asr_907, asr_920-10sz-pd, asr_920-10sz-pd_r, asr_920-12cz-a, asr_920-12cz-a_r, asr_920-12cz-d, asr_920-12cz-d_r, asr_920-12sz-im, asr_920-12sz-im_r, asr_920-24sz-im, asr_920-24sz-im_r, asr_920-24sz-m, asr_920-24sz-m_r, asr_920-24tz-m, asr_920-24tz-m_r, asr_920-4sz-a, asr_920-4sz-a_r, asr_920-4sz-d, asr_920-4sz-d_r, asr_920u-12sz-im, ios_xe
CVE-2021-34697 (published 2021-09-23)
A vulnerability in the Protection Against Distributed Denial of Service Attacks feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct denial of service (DoS) attacks to or through the affected device. This vulnerability is due to incorrect programming of the half-opened connections limit, TCP SYN flood limit, or TCP SYN cookie features when the features are configured in vulnerable releases of Cisco IOS XE Software. An attacker could exploit this vulnerability by attempting to flood traffic to or through the affected device. A successful exploit could allow the attacker to initiate a DoS attack to or through an affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-665
Affected vendors: cisco
Affected products: ios_xe
CVE-2021-34698 (published 2021-10-06)
A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to exhaust system memory and cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management in the proxy service of an affected device. An attacker could exploit this vulnerability by establishing a large number of HTTPS connections to the affected device. A successful exploit could allow the attacker to cause the system to stop processing new connections, which could result in a DoS condition. Note: Manual intervention may be required to recover from this situation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: cisco
Affected products: asyncos, web_security_appliance_s170, web_security_appliance_s190, web_security_appliance_s380, web_security_appliance_s390, web_security_appliance_s680, web_security_appliance_s690, web_security_appliance_s690x
CVE-2021-34699 (published 2021-09-23)
A vulnerability in the TrustSec CLI parser of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to an improper interaction between the web UI and the CLI parser. An attacker could exploit this vulnerability by requesting a particular CLI command to be run through the web UI. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-435
Affected vendors: cisco
Affected products: ios, ios_xe
CVE-2021-3470 (published 2021-03-31)
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-119
Affected vendors: redislabs
Affected products: redis
CVE-2021-34700 (published 2021-07-22)
A vulnerability in the CLI interface of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read arbitrary files on the underlying file system of an affected system. This vulnerability exists because access to sensitive information on an affected system is not sufficiently controlled. An attacker could exploit this vulnerability by gaining unauthorized access to sensitive information on an affected system. A successful exploit could allow the attacker to create forged authentication requests and gain unauthorized access to the web UI of an affected system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: cisco
Affected products: catalyst_sd-wan_manager, sd-wan_vmanage
CVE-2021-34701 (published 2021-11-04)
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), and Cisco Unity Connection could allow an authenticated, remote attacker to access sensitive data on an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
Affected vendors: cisco
Affected products: unified_communications_manager, unified_communications_manager_im_and_presence_service, unity_connection
CVE-2021-34702 (published 2021-10-06)
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to improper enforcement of administrator privilege levels for low-value sensitive data. An attacker with read-only administrator access to the web-based management interface could exploit this vulnerability by browsing to the page that contains the sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2021-34703 (published 2021-09-23)
A vulnerability in the Link Layer Discovery Protocol (LLDP) message parser of Cisco IOS Software and Cisco IOS XE Software could allow an attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improper initialization of a buffer. An attacker could exploit this vulnerability via any of the following methods: An authenticated, remote attacker could access the LLDP neighbor table via either the CLI or SNMP while the device is in a specific state. An unauthenticated, adjacent attacker could corrupt the LLDP neighbor table by injecting specific LLDP frames into the network and then waiting for an administrator of the device or a network management system (NMS) managing the device to retrieve the LLDP neighbor table of the device via either the CLI or SNMP. An authenticated, adjacent attacker with SNMP read-only credentials or low privileges on the device CLI could corrupt the LLDP neighbor table by injecting specific LLDP frames into the network and then accessing the LLDP neighbor table via either the CLI or SNMP. A successful exploit could allow the attacker to cause the affected device to crash, resulting in a reload of the device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-456
Affected vendors: cisco
Affected products: 1000_integrated_services_router, 1100-4g\/6g_integrated_services_router, 1100-4p_integrated_services_router, 1100-8p_integrated_services_router, 1100_integrated_services_router, 1101-4p_integrated_services_router, 1101_integrated_services_router, 1109-2p_integrated_services_router, 1109-4p_integrated_services_router, 1109_integrated_services_router, 1111x-8p_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4000_integrated_services_router, 4221_integrated_services_router, 4321_integrated_services_router, 4331_integrated_services_router, 4351_integrated_services_router, 4431_integrated_services_router, 4451-x_integrated_services_router, 4451_integrated_services_router, 4461_integrated_services_router, catalyst_3650-12x48fd-e
CVE-2021-34704 (published 2022-01-11)
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: adaptive_security_appliance_software, firepower_threat_defense
CVE-2021-34705 (published 2021-09-23)
A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured destination patterns and dial arbitrary numbers. This vulnerability is due to insufficient validation of dial strings at Foreign Exchange Office (FXO) interfaces. An attacker could exploit this vulnerability by sending a malformed dial string to an affected device via either the ISDN protocol or SIP. A successful exploit could allow the attacker to conduct toll fraud, resulting in unexpected financial impact to affected customers.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-232
Affected vendors: cisco
Affected products: ios, ios_xe
CVE-2021-34706 (published 2021-10-06)
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by uploading a crafted XML file that contains references to external entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the web application to perform arbitrary HTTP requests on behalf of the attacker.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-611
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2021-34707 (published 2021-08-04)
A vulnerability in the REST API of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect sensitive data when responding to an API request. An attacker could exploit the vulnerability by sending a specific API request to the affected application. A successful exploit could allow the attacker to obtain sensitive information about the application.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: evolved_programmable_network_manager
CVE-2021-34708 (published 2021-09-09)
Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR Software for Cisco 8000 Series Routers could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-347
Affected vendors: cisco
Affected products: 8101-32fh, 8101-32h, 8102-64h, 8201, 8201-32fh, 8202, 8800_12-slot, 8800_18-slot, 8800_4-slot, 8800_8-slot, ios_xr, n540-12z20g-sys-a, n540-12z20g-sys-d, n540-24z8q2c-m, n540-24z8q2c-sys, n540-28z4c-sys-a, n540-28z4c-sys-d, n540-acc-sys, n540x-12z16g-sys-a, n540x-12z16g-sys-d, n540x-16z4g8q2c-a, n540x-16z4g8q2c-d, n540x-acc-sys
CVE-2021-34709 (published 2021-09-09)
Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers, only when running Cisco IOS XR NCS540L software images, and Cisco IOS XR Software for Cisco 8000 Series Routers could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-347
Affected vendors: cisco
Affected products: 8101-32fh, 8101-32h, 8102-64h, 8201, 8201-32fh, 8202, 8800_12-slot, 8800_18-slot, 8800_4-slot, 8800_8-slot, ios_xr, n540-12z20g-sys-a, n540-12z20g-sys-d, n540-24z8q2c-m, n540-24z8q2c-sys, n540-28z4c-sys-a, n540-28z4c-sys-d, n540-acc-sys, n540x-12z16g-sys-a, n540x-12z16g-sys-d, n540x-16z4g8q2c-a, n540x-16z4g8q2c-d, n540x-acc-sys
CVE-2021-34710 (published 2021-10-06)
Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting in remote code execution or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-770
Affected vendors: cisco
Affected products: ata_190, ata_190_firmware, ata_191, ata_191_firmware, ata_192, ata_192_firmware
CVE-2021-34711 (published 2021-10-06)
A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug shell command. A successful exploit could allow the attacker to read any file on the device file system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-36
Affected vendors: cisco
Affected products: ip_conference_phone_7832, ip_conference_phone_7832_firmware, ip_conference_phone_8832, ip_conference_phone_8832_firmware, ip_phone_7811, ip_phone_7811_firmware, ip_phone_7821, ip_phone_7821_firmware, ip_phone_7832, ip_phone_7832_firmware, ip_phone_7841, ip_phone_7841_firmware, ip_phone_7861, ip_phone_7861_firmware, ip_phone_8811, ip_phone_8811_firmware, ip_phone_8831, ip_phone_8831_firmware, ip_phone_8841, ip_phone_8841_firmware, ip_phone_8845, ip_phone_8845_firmware, ip_phone_8851, ip_phone_8851_firmware, ip_phone_8861
CVE-2021-34712 (published 2021-09-23)
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the interface of an affected system. A successful exploit could allow the attacker to obtain sensitive information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-943
Affected vendors: cisco
Affected products: catalyst_sd-wan_manager, sd-wan_vmanage
CVE-2021-34713 (published 2021-09-09)
A vulnerability in the Layer 2 punt code of Cisco IOS XR Software running on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to cause the affected line card to reboot. This vulnerability is due to incorrect handling of specific Ethernet frames that cause a spin loop that can make the network processors unresponsive. An attacker could exploit this vulnerability by sending specific types of Ethernet frames on the segment where the affected line cards are attached. A successful exploit could allow the attacker to cause the affected line card to reboot.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-399
Affected vendors: cisco
Affected products: asr_9000, asr_9000v-v2, asr_9001, asr_9006, asr_9010, asr_9901, asr_9902, asr_9903, asr_9904, asr_9906, asr_9910, asr_9912, asr_9922, ios_xr
CVE-2021-34714 (published 2021-09-23)
A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software, Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload. This vulnerability is due to improper input validation of the UDLD packets. An attacker could exploit this vulnerability by sending specifically crafted UDLD packets to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. Note: The UDLD feature is disabled by default, and the conditions to exploit this vulnerability are strict. An attacker must have full control of a directly connected device. On Cisco IOS XR devices, the impact is limited to the reload of the UDLD process.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: cisco
Affected products: firepower_4100, firepower_4110, firepower_4112, firepower_4115, firepower_4120, firepower_4125, firepower_4140, firepower_4145, firepower_4150, firepower_9300, firepower_9300_sm-24, firepower_9300_sm-36, firepower_9300_sm-40, firepower_9300_sm-44, firepower_9300_sm-44_x_3, firepower_9300_sm-48, firepower_9300_sm-56, firepower_9300_sm-56_x_3, firepower_9300_with_1_sm-24_module, firepower_9300_with_1_sm-36_module, firepower_9300_with_1_sm-44_module, firepower_9300_with_3_sm-44_module, firepower_extensible_operating_system, fxos, ios
CVE-2021-34715 (published 2021-08-18)
A vulnerability in the image verification function of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with internal user privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges (the _nobody account) on the underlying operating system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-347
Affected vendors: cisco
Affected products: expressway, telepresence_video_communication_server
CVE-2021-34716 (published 2021-08-18)
A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as the root user. This vulnerability is due to incorrect handling of certain crafted software images that are uploaded to the affected device. An attacker could exploit this vulnerability by authenticating to the system as an administrative user and then uploading specific crafted software images to the affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-460
Affected vendors: cisco
Affected products: expressway, telepresence_video_communication_server
CVE-2021-34718 (published 2021-09-09)
A vulnerability in the SSH Server process of Cisco IOS XR Software could allow an authenticated, remote attacker to overwrite and read arbitrary files on the local device. This vulnerability is due to insufficient input validation of arguments that are supplied by the user for a specific file transfer method. An attacker with lower-level privileges could exploit this vulnerability by specifying Secure Copy Protocol (SCP) parameters when authenticating to a device. A successful exploit could allow the attacker to elevate their privileges and retrieve and upload files on a device that they should not have access to.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-88
Affected vendors: cisco
Affected products: asr_9000v-v2, asr_9001, asr_9006, asr_9010, asr_9901, asr_9902, asr_9903, asr_9904, asr_9906, asr_9910, asr_9912, asr_9922, ios_xr, ios_xrv, ios_xrv_9000, ncs_1001, ncs_1002, ncs_1004, ncs_4009, ncs_4016, ncs_5001, ncs_5002, ncs_5011, ncs_520, ncs_540
CVE-2021-34719 (published 2021-09-09)
Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: cisco
Affected products: 8101-32fh, 8101-32h, 8102-64h, 8201, 8201-32fh, 8202, 8804, 8808, 8812, 8818, asr_9000v-v2, asr_9001, asr_9006, asr_9010, asr_9901, asr_9902, asr_9903, asr_9904, asr_9906, asr_9910, asr_9912, asr_9922, ios_xr, ios_xrv, ios_xrv_9000
CVE-2021-3472 (published 2021-04-26)
A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-191
Affected vendors: debian, fedoraproject, redhat, x.org
Affected products: debian_linux, enterprise_linux, fedora, x_server
CVE-2021-34720 (published 2021-09-09)
A vulnerability in the IP Service Level Agreements (IP SLA) responder and Two-Way Active Measurement Protocol (TWAMP) features of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause device packet memory to become exhausted or cause the IP SLA process to crash, resulting in a denial of service (DoS) condition. This vulnerability exists because socket creation failures are mishandled during the IP SLA and TWAMP processes. An attacker could exploit this vulnerability by sending specific IP SLA or TWAMP packets to an affected device. A successful exploit could allow the attacker to exhaust the packet memory, which will impact other processes, such as routing protocols, or crash the IP SLA process.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-771
Affected vendors: cisco
Affected products: 8101-32fh, 8101-32h, 8102-64h, 8201, 8201-32fh, 8202, 8804, 8808, 8812, 8818, asr_9000v-v2, asr_9001, asr_9006, asr_9010, asr_9901, asr_9902, asr_9903, asr_9904, asr_9906, asr_9910, asr_9912, asr_9922, ios_xr, ios_xrv, ios_xrv_9000
CVE-2021-34721 (published 2021-09-09)
Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: cisco
Affected products: 8101-32fh, 8101-32h, 8102-64h, 8201, 8201-32fh, 8202, 8804, 8808, 8812, 8818, asr_9000v-v2, asr_9001, asr_9006, asr_9010, asr_9901, asr_9902, asr_9903, asr_9904, asr_9906, asr_9910, asr_9912, asr_9922, ios_xr, ios_xrv, ios_xrv_9000
CVE-2021-34722 (published 2021-09-09)
Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to gain access to the underlying root shell of an affected device and execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: cisco
Affected products: 8101-32fh, 8101-32h, 8102-64h, 8201, 8201-32fh, 8202, 8804, 8808, 8812, 8818, asr_9000v-v2, asr_9001, asr_9006, asr_9010, asr_9901, asr_9902, asr_9903, asr_9904, asr_9906, asr_9910, asr_9912, asr_9922, ios_xr, ios_xrv, ios_xrv_9000
CVE-2021-34723 (published 2021-09-23)
A vulnerability in a specific CLI command that is run on Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the configuration database of an affected device. This vulnerability is due to insufficient validation of specific CLI command parameters. An attacker could exploit this vulnerability by issuing that command with specific parameters. A successful exploit could allow the attacker to overwrite the content of the configuration database and gain root-level access to an affected device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-668
Affected vendors: cisco
Affected products: 1100-4g_integrated_services_router, 1100-4gltegb_integrated_services_router, 1100-4gltena_integrated_services_router, 1100-6g_integrated_services_router, 1100-lte_integrated_services_router, 1100_integrated_services_router, 4321_integrated_services_router, 4331_integrated_services_router, 4351_integrated_services_router, 4431_integrated_services_router, asr_1000-x, asr_1001, asr_1001-x, asr_1002, asr_1002-x, asr_1004, asr_1006, asr_1013, asr_1023, csr1000v, ios_xe
CVE-2021-34724 (published 2021-09-23)
A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to elevate privileges and execute arbitrary code on the underlying operating system as the root user. An attacker must be authenticated on an affected device as a PRIV15 user. This vulnerability is due to insufficient file system protection and the presence of a sensitive file in the bootflash directory on an affected device. An attacker could exploit this vulnerability by overwriting an installer file stored in the bootflash directory with arbitrary commands that can be executed with root-level privileges. A successful exploit could allow the attacker to read and write changes to the configuration database on the affected device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-284
Affected vendors: cisco
Affected products: 1000_integrated_services_router, 1100-4g\/6g_integrated_services_router, 1100-4p_integrated_services_router, 1100-8p_integrated_services_router, 1100_integrated_services_router, 1101-4p_integrated_services_router, 1101_integrated_services_router, 1109-2p_integrated_services_router, 1109-4p_integrated_services_router, 1109_integrated_services_router, 1111x-8p_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4000_integrated_services_router, 4221_integrated_services_router, 422_integrated_services_router, 4321_integrated_services_router, 4331_integrated_services_router, 4351_integrated_services_router, 4431_integrated_services_router, 4451-x_integrated_services_router, 4451_integrated_services_router, 4461_integrated_services_router
CVE-2021-34725 (published 2021-09-23)
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to an affected device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to execute commands with root-level privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: cisco
Affected products: 1000_integrated_services_router, 1100-4g\/6g_integrated_services_router, 1100-4p_integrated_services_router, 1100-8p_integrated_services_router, 1100_integrated_services_router, 1101-4p_integrated_services_router, 1101_integrated_services_router, 1109-2p_integrated_services_router, 1109-4p_integrated_services_router, 1109_integrated_services_router, 1111x-8p_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4000_integrated_services_router, 4221_integrated_services_router, 422_integrated_services_router, 4321_integrated_services_router, 4331_integrated_services_router, 4351_integrated_services_router, 4431_integrated_services_router, 4451-x_integrated_services_router, 4451_integrated_services_router, 4461_integrated_services_router
CVE-2021-34726 (published 2021-09-23)
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system of an affected device. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to an affected device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to execute commands with root-level privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: cisco
Affected products: sd-wan
CVE-2021-34727 (published 2021-09-23)
A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. This vulnerability is due to insufficient bounds checking when an affected device processes traffic. An attacker could exploit this vulnerability by sending crafted traffic to the device. A successful exploit could allow the attacker to cause a buffer overflow and possibly execute arbitrary commands with root-level privileges, or cause the device to reload, which could result in a denial of service condition.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: cisco
Affected products: 1000_integrated_services_router, 1100-4g\/6g_integrated_services_router, 1100-4p_integrated_services_router, 1100-8p_integrated_services_router, 1100_integrated_services_router, 1101-4p_integrated_services_router, 1101_integrated_services_router, 1109-2p_integrated_services_router, 1109-4p_integrated_services_router, 1109_integrated_services_router, 1111x-8p_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 4000_integrated_services_router, 4221_integrated_services_router, 422_integrated_services_router, 4321_integrated_services_router, 4331_integrated_services_router, 4351_integrated_services_router, 4431_integrated_services_router, 4451-x_integrated_services_router, 4451_integrated_services_router, 4461_integrated_services_router
CVE-2021-34728 (published 2021-09-09)
Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: cisco
Affected products: 8101-32fh, 8101-32h, 8102-64h, 8201, 8201-32fh, 8202, 8804, 8808, 8812, 8818, asr_9000v-v2, asr_9001, asr_9006, asr_9010, asr_9901, asr_9902, asr_9903, asr_9904, asr_9906, asr_9910, asr_9912, asr_9922, ios_xr, ios_xrv, ios_xrv_9000
CVE-2021-34729 (published 2021-09-23)
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input in the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system. An attacker would need valid user credentials to exploit this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: cisco
Affected products: ios_xe, ios_xe_sd-wan
CVE-2021-3473 (published 2021-04-13)
An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-319
Affected vendors: lenovo
Affected products: thinkagile_hx1320, thinkagile_hx2320, thinkagile_hx3320, thinkagile_hx3375, thinkagile_hx3520-g, thinkagile_hx3720, thinkagile_hx5520, thinkagile_hx7520, thinkagile_hx7820, thinkagile_mx1020, thinkagile_mx_certified_nodes, thinkagile_vx_1u, thinkagile_vx_2u, thinkagile_vx_dense, thinksystem_sd530, thinksystem_sd650, thinksystem_se350, thinksystem_sn550, thinksystem_sn850, thinksystem_sr150, thinksystem_sr158, thinksystem_sr250, thinksystem_sr258, thinksystem_sr530, thinksystem_sr570
CVE-2021-34730 (published 2021-08-18)
A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of incoming UPnP traffic. An attacker could exploit this vulnerability by sending a crafted UPnP request to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a DoS condition. Cisco has not released software updates that address this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: cisco
Affected products: application_extension_platform, rv110w_wireless-n_vpn_firewall, rv110w_wireless-n_vpn_firewall_firmware, rv130_vpn_router, rv130_vpn_router_firmware, rv130w_wireless-n_multifunction_vpn_router, rv130w_wireless-n_multifunction_vpn_router_firmware, rv215w_wireless-n_vpn_router, rv215w_wireless-n_vpn_router_firmware
CVE-2021-34731 (published 2021-11-04)
A vulnerability in the web-based management interface of Cisco Prime Access Registrar could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need valid administrative credentials. Cisco expects to release software updates that address this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: prime_access_registrar
CVE-2021-34732 (published 2021-09-02)
A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: prime_collaboration_provisioning
CVE-2021-34733 (published 2021-09-02)
A vulnerability in the CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, local attacker to access sensitive information stored on the underlying file system of an affected system. This vulnerability exists because sensitive information is not sufficiently secured when it is stored. An attacker could exploit this vulnerability by gaining unauthorized access to sensitive information on an affected system. A successful exploit could allow the attacker to create forged authentication requests and gain unauthorized access to the affected system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: cisco
Affected products: evolved_programmable_network_manager, prime_infrastructure
CVE-2021-34734 (published 2021-08-18)
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for the Cisco Video Surveillance 7000 Series IP Cameras firmware could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper management of memory resources, referred to as a double free. An attacker could exploit this vulnerability by sending crafted LLDP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-415
Affected vendors: cisco
Affected products: video_surveillance_7000_ip_camera_firmware
CVE-2021-34735 (published 2021-10-06)
Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting in remote code execution or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: cisco
Affected products: ata_190, ata_190_firmware, ata_191, ata_191_firmware, ata_192, ata_192_firmware
CVE-2021-34736 (published 2021-10-21)
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to cause the web-based management interface to unexpectedly restart. The vulnerability is due to insufficient input validation on the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to cause the interface to restart, resulting in a denial of service (DoS) condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: cisco
Affected products: ucs_c125_m5, ucs_c220_m3, ucs_c220_m4, ucs_c220_m5, ucs_c225_m6, ucs_c22_m3, ucs_c240_m3, ucs_c240_m5, ucs_c240_sd_m5, ucs_c245_m6, ucs_c24_m3, ucs_c260_m2, ucs_c3160, ucs_c3260, ucs_c4200, ucs_c420_m3, ucs_c460_m2, ucs_c460_m4, ucs_c480_m5, ucs_c480_ml_m5, ucs_c890_m5, ucs_s3260, unified_computing_system
CVE-2021-34737 (published 2021-09-09)
A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process, resulting in a denial of service (DoS) condition. This vulnerability exists because certain DHCPv4 messages are improperly validated when they are processed by an affected device. An attacker could exploit this vulnerability by sending a malformed DHCPv4 message to an affected device. A successful exploit could allow the attacker to cause a NULL pointer dereference, resulting in a crash of the dhcpd process. While the dhcpd process is restarting, which may take up to approximately two minutes, DHCPv4 server services are unavailable on the affected device. This could temporarily prevent network access to clients that join the network during that time period. Note: Only the dhcpd process crashes and eventually restarts automatically. The router does not reload.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: cisco
Affected products: asr_9000v-v2, asr_9001, asr_9006, asr_9010, asr_9901, asr_9902, asr_9903, asr_9904, asr_9906, asr_9910, asr_9912, asr_9922, ios_xr, ios_xrv_9000, ncs540-12z20g-sys-a, ncs540-12z20g-sys-d, ncs540-24z8q2c-m, ncs540-24z8q2c-sys, ncs540-28z4c-sys-a, ncs540-28z4c-sys-d, ncs540-acc-sys, ncs540x-12z16g-sys-a, ncs540x-12z16g-sys-d, ncs540x-16z4g8q2c-a, ncs540x-16z4g8q2c-d
CVE-2021-34738 (published 2021-10-21)
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2021-34739 (published 2021-11-04)
A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to replay valid user session credentials and gain unauthorized access to the web-based management interface of an affected device. This vulnerability is due to insufficient expiration of session credentials. An attacker could exploit this vulnerability by conducting a man-in-the-middle attack against an affected device to intercept valid session credentials and then replaying the intercepted credentials toward the same device at a later time. A successful exploit could allow the attacker to access the web-based management interface with administrator privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-613
Affected vendors: cisco
Affected products: cbs250-16p-2g, cbs250-16p-2g_firmware, cbs250-16t-2g, cbs250-16t-2g_firmware, cbs250-24fp-4g, cbs250-24fp-4g_firmware, cbs250-24fp-4x, cbs250-24fp-4x_firmware, cbs250-24p-4g, cbs250-24p-4g_firmware, cbs250-24p-4x, cbs250-24p-4x_firmware, cbs250-24pp-4g, cbs250-24pp-4g_firmware, cbs250-24t-4g, cbs250-24t-4g_firmware, cbs250-24t-4x, cbs250-24t-4x_firmware, cbs250-48p-4g, cbs250-48p-4g_firmware, cbs250-48p-4x, cbs250-48p-4x_firmware, cbs250-48pp-4g, cbs250-48pp-4g_firmware, cbs250-48t-4g
CVE-2021-3474 (published 2021-03-30)
There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHufDecoder, potentially leading to problems with application availability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-190
Affected vendors: debian, openexr
Affected products: debian_linux, openexr
CVE-2021-34740 (published 2021-09-23)
A vulnerability in the WLAN Control Protocol (WCP) implementation for Cisco Aironet Access Point (AP) software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect error handling when an affected device receives an unexpected 802.11 frame. An attacker could exploit this vulnerability by sending certain 802.11 frames over the wireless network to an interface on an affected AP. A successful exploit could allow the attacker to cause a packet buffer leak. This could eventually result in buffer allocation failures, which would trigger a reload of the affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: cisco
Affected products: 1100-4g\/6g_integrated_services_router, 1100-4p_integrated_services_router, 1100-8p_integrated_services_router, 1100_integrated_services_router, 1101-4p_integrated_services_router, 1101_integrated_services_router, 1109-2p_integrated_services_router, 1109-4p_integrated_services_router, 1109_integrated_services_router, 1111x-8p_integrated_services_router, 1111x_integrated_services_router, 111x_integrated_services_router, 1120_integrated_services_router, 1160_integrated_services_router, 6300_series_access_points, aironet_1540, aironet_1542d, aironet_1542i, aironet_1560, aironet_1562d, aironet_1562e, aironet_1562i, aironet_1800, aironet_1800i, aironet_1810