TL;DR 📌

Multiple vulnerabilities in Cisco IOS XE Software could allow an authenticated local attacker or an unauthenticated attacker with physical access to execute persistent code at boot time, compromising device security. Cisco has released fixed software, and no workarounds are available.

What happened 🕵️‍♂️

Cisco has identified multiple vulnerabilities in its IOS XE Software that could allow an attacker to bypass secure boot mechanisms. These vulnerabilities stem from improper validation of software packages, enabling an attacker to place a crafted file on an affected device. This could lead to the execution of persistent code on the operating system, effectively breaking the chain of trust.

TL;DR 📌

A denial of service (DoS) vulnerability has been identified in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software. An authenticated remote attacker can exploit this vulnerability to cause affected devices to reload unexpectedly. The highest CVSS score for this vulnerability is 7.7, categorized as High severity. Cisco has released software updates to address this issue, but there are no workarounds available.