CVSS: 7.7EPSS: 0%CPEs: 40EXPL: 0CVE-2024-20278
https://notcve.org/view.php?id=CVE-2024-20278
27 Mar 2024 — A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root. Una vulnerabilidad en la función NETCONF del software Cisco IOS XE podría ... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX • CWE-184: Incomplete List of Disallowed Inputs •
CVSS: 6.0EPSS: 0%CPEs: 9EXPL: 0CVE-2024-20306
https://notcve.org/view.php?id=CVE-2024-20306
27 Mar 2024 — A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted CLI command to an affected device. A successful exploit could allow... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-utd-cmd-JbL8KvHT • CWE-233: Improper Handling of Parameters •
CVSS: 8.6EPSS: 0%CPEs: 181EXPL: 0CVE-2024-20314
https://notcve.org/view.php?id=CVE-2024-20314
27 Mar 2024 — A vulnerability in the IPv4 Software-Defined Access (SD-Access) fabric edge node feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause high CPU utilization and stop all traffic processing, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain IPv4 packets. An attacker could exploit this vulnerability by sending certain IPv4 packets to an affected device. A successful exploit could allow the attack... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-sda-edge-dos-qZWuWXWG • CWE-783: Operator Precedence Logic Error •
CVSS: 7.4EPSS: 0%CPEs: 441EXPL: 0CVE-2024-20312
https://notcve.org/view.php?id=CVE-2024-20312
27 Mar 2024 — A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation when parsing an ingress IS-IS packet. An attacker could exploit this vulnerability by sending a crafted IS-IS packet to an affected device after forming an adjacency. A successful exploit could allow the ... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-sGjyOUHX • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 60EXPL: 0CVE-2024-20324
https://notcve.org/view.php?id=CVE-2024-20324
27 Mar 2024 — A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, low-privileged, local attacker to access WLAN configuration details including passwords. This vulnerability is due to improper privilege checks. An attacker could exploit this vulnerability by using the show and show tech wireless CLI commands to access configuration details, including passwords. A successful exploit could allow the attacker to access configuration details that they are not authorized to access. Una vulnerabil... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-wlc-privesc-RjSMrmPK • CWE-274: Improper Handling of Insufficient Privileges •
CVSS: 8.6EPSS: 0%CPEs: 77EXPL: 0CVE-2024-20259
https://notcve.org/view.php?id=CVE-2024-20259
27 Mar 2024 — A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a crafted IPv4 DHCP request packet being mishandled when endpoint analytics are enabled. An attacker could exploit this vulnerability by sending a crafted DHCP request through an affected device. A successful exploit could allow the attacker to cause the device t... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dhcp-dos-T3CXPO9z • CWE-122: Heap-based Buffer Overflow •
CVSS: 8.6EPSS: 0%CPEs: 373EXPL: 0CVE-2024-20311
https://notcve.org/view.php?id=CVE-2024-20311
27 Mar 2024 — A vulnerability in the Locator ID Separation Protocol (LISP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to the incorrect handling of LISP packets. An attacker could exploit this vulnerability by sending a crafted LISP packet to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. Note: This ... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lisp-3gYXs3qP • CWE-674: Uncontrolled Recursion •
CVSS: 5.8EPSS: 0%CPEs: 160EXPL: 0CVE-2024-20316
https://notcve.org/view.php?id=CVE-2024-20316
27 Mar 2024 — A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access resources that should have been protected by a configured IPv4 access control list (ACL). This vulnerability is due to improper handling of error conditions when a successfully authorized device administrator updates an IPv4 ACL using the NETCONF or RESTCONF protocol, and the update would reorder access control entries (ACEs) in the updated ACL. An attacker could expl... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dmi-acl-bypass-Xv8FO8Vz • CWE-390: Detection of Error Condition Without Action •
CVSS: 4.3EPSS: 0%CPEs: 26EXPL: 0CVE-2024-20333
https://notcve.org/view.php?id=CVE-2024-20333
27 Mar 2024 — A vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to change specific data within the interface on an affected device. This vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to change a specific field within the web-based management interface, even... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccc-authz-bypass-5EKchJRb • CWE-285: Improper Authorization •
CVSS: 4.3EPSS: 0%CPEs: 93EXPL: 0CVE-2024-20319
https://notcve.org/view.php?id=CVE-2024-20319
13 Mar 2024 — A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane protection policies and access the Simple Network Management Plane (SNMP) server of an affected device. This vulnerability is due to incorrect UDP forwarding programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by attempting to perform an SNMP operation using broadcast as the destination address that ... • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-uhv6ZDeF • CWE-284: Improper Access Control •