CVSS: 6.5EPSS: 0%CPEs: 187EXPL: 0CVE-2017-6665
https://notcve.org/view.php?id=CVE-2017-6665
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to reset the Autonomic Control Plane (ACP) of an affected system and view ACP packets that are transferred in clear text within an affected system, an Information Disclosure Vulnerability. More Information: CSCvd51214. Known Affected Releases: Denali-16.2.1 Denali-16.3.1. Una vulnerabilidad en la funcionalidad Autonomic Networking de Cisco IOS Software y Cisco IOS XE Software podría permitir que un atacante adyacente sin autenticar reinicie el Autonomic Control Plane (ACP) de un sistema afectado y vea los paquetes ACP que se transfieren sin cifrar dentro de un sistema afectado (vulnerabilidad de divulgación de información). Más información: CSCvd51214. • http://www.securityfocus.com/bid/99969 http://www.securitytracker.com/id/1038998 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170726-aniacp • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5030
https://notcve.org/view.php?id=CVE-2012-5030
Cisco IOS before 15.2(4)S6 does not initialize an unspecified variable, which might allow remote authenticated users to cause a denial of service (CPU consumption, watchdog timeout, crash) by walking specific SNMP objects. Cisco IOS en versiones anteriores a 15.2(4)S6 no inicializa una variable no especificada, lo que podría permitir que usuarios remotos autenticados provoquen una denegación de servicio (consumo de CPU, watchdog timeout, caída del sistema) recorriendo objetos SNMP específicos. • https://www.cisco.com/c/en/us/td/docs/ios/15_2s/release/notes/15_2s_rel_notes/15_2s_caveats_15_2_4s.html • CWE-399: Resource Management Errors •
CVSS: 6.9EPSS: 0%CPEs: 164EXPL: 0CVE-2017-6606
https://notcve.org/view.php?id=CVE-2017-6606
A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known Affected Releases: 15.6(1.1)S 16.1.2 16.2.0 15.2(1)E. Known Fixed Releases: Denali-16.1.3 16.2(1.8) 16.1(2.61) 15.6(2)SP 15.6(2)S1 15.6(1)S2 15.5(3)S3a 15.5(3)S3 15.5(2)S4 15.5(1)S4 15.4(3)S6a 15.4(3)S6 15.3(3)S8a 15.3(3)S8 15.2(5)E 15.2(4)E3 15.2(3)E5 15.0(2)SQD3 15.0(1.9.2)SQD3 3.9(0)E. Una vulnerabilidad en una secuencia de comandos de inicio del software Cisco IOS XE podría permitir a un atacante no autenticado con acceso físico al sistema de destino ejecutar comandos arbitrarios en el sistema operativo subyacente con los privilegios del usuario root. • http://www.securityfocus.com/bid/97434 http://www.securitytracker.com/id/1038190 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-iosxe • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 198EXPL: 0CVE-2017-3856
https://notcve.org/view.php?id=CVE-2017-3856
A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. An attacker could exploit this vulnerability by sending a high number of requests to the web user interface of the affected software. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. To exploit this vulnerability, the attacker must have access to the management interface of the affected software, which is typically connected to a restricted management network. • http://www.securityfocus.com/bid/97007 http://www.securitytracker.com/id/1038101 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-webui • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 41EXPL: 0CVE-2017-3859
https://notcve.org/view.php?id=CVE-2017-3859
A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted DHCP packet for Zero Touch Provisioning. An attacker could exploit this vulnerability by sending a specially crafted DHCP packet to an affected device. An exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. This vulnerability affects Cisco ASR 920 Series Aggregation Services Routers that are running an affected release of Cisco IOS XE Software (3.13 through 3.18) and are listening on the DHCP server port. • http://www.securityfocus.com/bid/97008 http://www.securitytracker.com/id/1038104 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-ztp • CWE-134: Use of Externally-Controlled Format String •