Cisco vulnerabilities attackers have used

Every Cisco entry in CISA KEV

1. CVE-2026-20320

   Added Nov 10, 2026 · due Nov 24, 2026

   Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability

   Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.

2. CVE-2026-76418

   Added Oct 29, 2026 · due Nov 1, 2026

   Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

   Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly…

3. CVE-2026-76519

   Added Oct 14, 2026 · due Oct 17, 2026

   Cisco Secure Email Gateway Relative Path Traversal Vulnerability

   Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

4. CVE-2026-76504

   Added Sep 30, 2026 · due Oct 3, 2026

   Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

   Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP…

5. CVE-2026-76460

   Added Sep 16, 2026 · due Sep 19, 2026

   Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

   Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the…

6. CVE-2026-76461

   Added Sep 14, 2026 · due Sep 17, 2026

   Cisco Secure Email Gateway SQL Injection Vulnerability

   Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

7. CVE-2026-20079

   Added Sep 9, 2026 · due Sep 12, 2026

   Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability

   Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote…

8. CVE-2026-20349

   Added Aug 11, 2026 · due Aug 14, 2026

   Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

   Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly…

9. CVE-2026-20316

   RansomwareAdded Jul 29, 2026 · due Aug 1, 2026

   Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

   Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a…

10. CVE-2008-4128

    Added Jul 13, 2026 · due Jul 16, 2026

    Cisco IOS Cross-Site Request Forgery Vulnerability

    Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command…

11. CVE-2026-20230

    Added Jun 25, 2026 · due Jun 28, 2026

    Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

    Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote…

12. CVE-2026-20262

    Added Jun 15, 2026 · due Jun 29, 2026

    Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

    Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

13. CVE-2026-20245

    Added Jun 9, 2026 · due Jun 23, 2026

    Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

    Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a…

14. CVE-2026-20182

    Added May 14, 2026 · due May 17, 2026

    Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

    Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

15. CVE-2026-20133

    Added Apr 20, 2026 · due Apr 23, 2026

    Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

    Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

16. CVE-2026-20128

    Added Apr 20, 2026 · due Apr 23, 2026

    Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

    Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as…

17. CVE-2026-20122

    Added Apr 20, 2026 · due Apr 23, 2026

    Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

    Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file…

18. CVE-2026-20131

    RansomwareAdded Mar 19, 2026 · due Mar 22, 2026

    Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability

    Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an…

19. CVE-2026-20127

    Added Feb 25, 2026 · due Feb 27, 2026

    Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

    Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, remote attacker to bypass authentication…

20. CVE-2022-20775

    Added Feb 25, 2026 · due Feb 27, 2026

    Cisco SD-WAN Path Traversal Vulnerability

    Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the…

21. CVE-2026-20045

    Added Jan 21, 2026 · due Feb 11, 2026

    Cisco Unified Communications Products Code Injection Vulnerability

    Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and…

22. CVE-2025-20393

    Added Dec 17, 2025 · due Dec 24, 2025

    Cisco Multiple Products Improper Input Validation Vulnerability

    Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying…

23. CVE-2025-20352

    Added Sep 29, 2025 · due Oct 20, 2025

    Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

    Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a…

24. CVE-2025-20362

    Added Sep 25, 2025 · due Sep 26, 2025

    Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

    Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.

25. CVE-2025-20333

    Added Sep 25, 2025 · due Sep 26, 2025

    Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

    Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained…

26. CVE-2025-20337

    Added Jul 28, 2025 · due Aug 18, 2025

    Cisco Identity Services Engine Injection Vulnerability

    Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a…

27. CVE-2025-20281

    Added Jul 28, 2025 · due Aug 18, 2025

    Cisco Identity Services Engine Injection Vulnerability

    Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a…

28. CVE-2024-20439

    Added Mar 31, 2025 · due Apr 21, 2025

    Cisco Smart Licensing Utility Static Credential Vulnerability

    Cisco Smart Licensing Utility contains a static credential vulnerability that allows an unauthenticated, remote attacker to log in to an affected system and gain administrative credentials.

29. CVE-2023-20118

    Added Mar 3, 2025 · due Mar 24, 2025

    Cisco Small Business RV Series Routers Command Injection Vulnerability

    Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and…

30. CVE-2014-2120

    Added Nov 12, 2024 · due Dec 3, 2024

    Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability

    Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

31. CVE-2024-20481

    Added Oct 24, 2024 · due Nov 14, 2024

    Cisco ASA and FTD Denial-of-Service Vulnerability

    Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS)…

32. CVE-2024-20399

    Added Jul 2, 2024 · due Jul 23, 2024

    Cisco NX-OS Command Injection Vulnerability

    Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.

33. CVE-2024-20359

    Added Apr 24, 2024 · due May 1, 2024

    Cisco ASA and FTD Privilege Escalation Vulnerability

    Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.

34. CVE-2024-20353

    Added Apr 24, 2024 · due May 1, 2024

    Cisco ASA and FTD Denial of Service Vulnerability

    Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.

35. CVE-2020-3259

    RansomwareAdded Feb 15, 2024 · due Mar 7, 2024

    Cisco ASA and FTD Information Disclosure Vulnerability

    Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of…

36. CVE-2023-20273

    Added Oct 23, 2023 · due Oct 27, 2023

    Cisco IOS XE Web UI Command Injection Vulnerability

    Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco…

37. CVE-2023-20198

    Added Oct 16, 2023 · due Oct 20, 2023

    Cisco IOS XE Web UI Privilege Escalation Vulnerability

    Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to…

38. CVE-2023-20109

    Added Oct 10, 2023 · due Oct 31, 2023

    Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

    Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key…

39. CVE-2023-20269

    RansomwareAdded Sep 13, 2023 · due Oct 4, 2023

    Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

    Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and…

40. CVE-2016-6415

    Added May 19, 2023 · due Jun 9, 2023

    Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability

    Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the…

41. CVE-2004-1464

    Added May 19, 2023 · due Jun 9, 2023

    Cisco IOS Denial-of-Service Vulnerability

    Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device.

42. CVE-2017-6742

    Added Apr 19, 2023 · due May 10, 2023

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to…

43. CVE-2020-3433

    RansomwareAdded Oct 24, 2022 · due Nov 14, 2022

    Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

    Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows…

44. CVE-2020-3153

    RansomwareAdded Oct 24, 2022 · due Nov 14, 2022

    Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

    Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges…

45. CVE-2019-15271

    Added Jun 8, 2022 · due Jun 22, 2022

    Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability

    A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.

46. CVE-2016-6367

    Added May 24, 2022 · due Jun 14, 2022

    Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

    A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.

47. CVE-2016-6366

    Added May 24, 2022 · due Jun 14, 2022

    Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

    A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.

48. CVE-2022-20821

    Added May 23, 2022 · due Jun 13, 2022

    Cisco IOS XR Open Port Vulnerability

    Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.

49. CVE-2018-0147

    Added Mar 25, 2022 · due Apr 15, 2022

    Cisco Secure Access Control System Java Deserialization Vulnerability

    A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure…

50. CVE-2018-0125

    Added Mar 25, 2022 · due Apr 15, 2022

    Cisco VPN Routers Remote Code Execution Vulnerability

    A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.

51. CVE-2017-3881

    Added Mar 25, 2022 · due Apr 15, 2022

    Cisco IOS and IOS XE Remote Code Execution Vulnerability

    A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with…

52. CVE-2015-0666

    Added Mar 25, 2022 · due Apr 15, 2022

    Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability

    Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.

53. CVE-2010-3035

    Added Mar 25, 2022 · due Apr 15, 2022

    Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

    Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

54. CVE-2009-2055

    Added Mar 25, 2022 · due Apr 15, 2022

    Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

    Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

55. CVE-2022-20708

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and…

56. CVE-2022-20703

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and…

57. CVE-2022-20701

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and…

58. CVE-2022-20700

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and…

59. CVE-2022-20699

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

    A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and…

60. CVE-2019-1652

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco Small Business Routers Improper Input Validation Vulnerability

    A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute…

61. CVE-2018-0180

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS Software Denial-of-Service Vulnerability

    A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.

62. CVE-2018-0179

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS Software Denial-of-Service Vulnerability

    A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.

63. CVE-2018-0175

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

    Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS)…

64. CVE-2018-0174

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability

    A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).

65. CVE-2018-0173

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS and IOS XE Software Improper Input Validation Vulnerability

    A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).

66. CVE-2018-0172

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS and IOS XE Software Improper Input Validation Vulnerability

    A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).

67. CVE-2018-0167

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

    There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a…

68. CVE-2018-0161

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS Software Resource Management Errors Vulnerability

    A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS)…

69. CVE-2018-0159

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability

    A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting…

70. CVE-2018-0158

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability

    A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting…

71. CVE-2018-0156

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability

    A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.

72. CVE-2018-0155

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability

    A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the…

73. CVE-2018-0154

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability

    A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.

74. CVE-2018-0151

    Added Mar 3, 2022 · due Mar 17, 2022

    Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability

    A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated…

75. CVE-2017-6744

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS Software SNMP Remote Code Execution Vulnerability

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An…

76. CVE-2017-6743

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

77. CVE-2017-6740

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to…

78. CVE-2017-6739

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to…

79. CVE-2017-6738

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

80. CVE-2017-6737

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

81. CVE-2017-6736

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

    The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

82. CVE-2017-6663

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability

    A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service…

83. CVE-2017-6627

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability

    A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service.

84. CVE-2017-12319

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability

    A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service…

85. CVE-2017-12240

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability

    The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an…

86. CVE-2017-12238

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability

    A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service.

87. CVE-2017-12237

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that…

88. CVE-2017-12235

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability

    A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.

89. CVE-2017-12234

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability

    There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.

90. CVE-2017-12233

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability

    There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.

91. CVE-2017-12232

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability

    A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in…

92. CVE-2017-12231

    Added Mar 3, 2022 · due Mar 24, 2022

    Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability

    A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service.

93. CVE-2021-1498

    Added Nov 3, 2021 · due Nov 17, 2021

    Cisco HyperFlex HX Data Platform Command Injection Vulnerability

    Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.

94. CVE-2021-1497

    Added Nov 3, 2021 · due Nov 17, 2021

    Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

    Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.

95. CVE-2020-3580

    RansomwareAdded Nov 3, 2021 · due May 3, 2022

    Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability

    Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to…

96. CVE-2020-3569

    Added Nov 3, 2021 · due May 3, 2022

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

    Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or…

97. CVE-2020-3566

    Added Nov 3, 2021 · due May 3, 2022

    Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

    Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or…

98. CVE-2020-3452

    Added Nov 3, 2021 · due May 3, 2022

    Cisco ASA and FTD Read-Only Path Traversal Vulnerability

    Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request…

99. CVE-2020-3161

    Added Nov 3, 2021 · due May 3, 2022

    Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

    Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.

100. CVE-2020-3118

     Added Nov 3, 2021 · due May 3, 2022

     Cisco IOS XR Software Discovery Protocol Format String Vulnerability

     Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an…

101. CVE-2019-1653

     Added Nov 3, 2021 · due May 3, 2022

     Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

     Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information.

102. CVE-2018-0296

     Added Nov 3, 2021 · due May 3, 2022

     Cisco Adaptive Security Appliance (ASA) Denial-of-Service Vulnerability

     Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.

103. CVE-2018-0171

     Added Nov 3, 2021 · due May 3, 2022

     Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

     Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected…

Related

• All vendors in CISA KEV

  Ranked by how many exploited vulnerabilities each has.

• Latest CVEs this week

  Critical and High CVEs from the last 7 days, with KEV and EPSS.

• Vulnerability watch

  A briefing and a fix pull request when an advisory hits your dependencies.