Cisco Catalyst SD-WAN Manager fails to properly validate certificates for its Smart Licensing connections, letting an attacker positioned to intercept internet traffic read the credentials used to reach Cisco’s cloud services.
Posts tagged: Cisco
Cisco Duo Self-Service Portal Command Injection Vulnerability
An unauthenticated attacker could inject arbitrary commands into emails sent from Cisco Duo’s cloud-hosted self-service portal, letting them slip malicious content to unsuspecting recipients.
Cisco Identity Services Engine RADIUS Denial of Service Vulnerability
A crafted RADIUS authentication request sent to any network device using Cisco ISE for AAA can force the ISE process to reload, knocking out authentication network-wide with no login needed.
Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches Secure Boot Bypass Vulnerability
Missing signature checks during boot on these Catalyst switches let a privileged local user or someone with physical access plant code that survives reboots and undermines the secure boot chain of trust.
Cisco IOS Software Industrial Ethernet Switch Device Manager Privilege Escalation Vulnerability
An authenticated user with only mid-level access on Cisco Industrial Ethernet switches can send a crafted HTTP request to the Device Manager and gain full administrative control.
Cisco IOS XE Software Bootstrap Arbitrary File Write Vulnerability
A tampered bootstrap file loaded during initial SD-WAN or SD-Routing setup lets an already-authenticated local user on a Cisco IOS XE device write arbitrary files to the underlying OS.
Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers ARP Denial
An unauthenticated attacker on the same network segment can flood an ASR 903 router with crafted ARP messages, exhausting memory and forcing a route switch processor reload.
Cisco IOS XE Wireless Controller Software Cisco Discovery Protocol Denial of
An unauthenticated attacker within radio or wired reach of a joined access point can send a malformed CDP packet that crashes the wireless controller, dropping the entire Wi-Fi network it manages.
Cisco IOS XE Wireless Controller Software Unauthorized User Deletion Vulnerability
A low-privileged lobby ambassador account on Cisco IOS XE Wireless Controllers can be used to delete any user account, including administrator ones, due to weak access control in that web interface.
Cisco Meraki MX and Z Series Teleworker Gateway AnyConnect VPN Denial of Service Vulnerabilities
Five separate flaws in the AnyConnect VPN server on Meraki MX and Z series gateways let an unauthenticated attacker drop existing SSL VPN sessions and block new ones from connecting.