CVSS: 6.8EPSS: 0%CPEs: 20EXPL: 0CVE-2022-20944 – Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-20944
A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to an improper check in the code function that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by loading unsigned software on an affected device. A successful exploit could allow the attacker to boot a malicious software image or execute unsigned code and bypass the image verification check part of the boot process of the affected device. To exploit this vulnerability, the attacker needs either unauthenticated physical access to the device or privileged access to the root shell on the device. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cat-verify-D4NEQA6q • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-20830 – Cisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-20830
A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC without authentication. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses. Una vulnerabilidad en el mecanismo de autenticación de Cisco Software-Defined Application Visibility and Control (SD-AVC) en Cisco vManage podría permitir a un atacante remoto no autenticado acceder a la GUI de Cisco SD-AVC sin autenticación. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-avc-NddSGB8 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.4EPSS: 0%CPEs: 8EXPL: 0CVE-2022-20945 – Cisco Catalyst 9100 Series Access Points Association Request Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-20945
A vulnerability in the 802.11 association frame validation of Cisco Catalyst 9100 Series Access Points (APs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of certain parameters within association request frames received by the AP. An attacker could exploit this vulnerability by sending a crafted 802.11 association request to a nearby device. An exploit could allow the attacker to unexpectedly reload the device, resulting in a DoS condition. Una vulnerabilidad en la comprobación de tramas de asociación 802.11 de los Puntos de Acceso (AP) de la Serie Catalyst 9100 de Cisco podría permitir a un atacante adyacente no autenticado causar una condición de denegación de servicio (DoS) en un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-assoc-dos-EgVqtON8 • CWE-20: Improper Input Validation CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.7EPSS: 0%CPEs: 19EXPL: 0CVE-2022-20930 – Cisco SD-WAN Software Arbitrary File Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2022-20930
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands that are executed as the root user account. A successful exploit could allow the attacker to overwrite arbitrary system files, which could result in a denial of service (DoS) condition. Una vulnerabilidad en la CLI del software Cisco SD-WAN podría permitir a un atacante local autenticado sobrescribir y posiblemente corromper archivos en un sistema afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-cli-xkGwmqKu • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 8.6EPSS: 0%CPEs: 322EXPL: 0CVE-2022-20919 – Cisco IOS and IOS XE Software Common Industrial Protocol Request Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-20919
A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient input validation during processing of CIP packets. An attacker could exploit this vulnerability by sending a malformed CIP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a DoS condition. Una vulnerabilidad en el procesamiento de paquetes malformados del Protocolo Industrial Común (CIP) que se envían al software Cisco IOS y al software Cisco IOS XE podría permitir a un atacante remoto no autenticado causar una recarga no esperada del dispositivo afectado, lo que provocaría una condición de denegación de servicio (DoS). • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-cip-dos-9rTbKLt9 • CWE-248: Uncaught Exception CWE-755: Improper Handling of Exceptional Conditions •