CVSS: 8.6EPSS: 0%CPEs: 77EXPL: 0CVE-2024-20259
https://notcve.org/view.php?id=CVE-2024-20259
A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a crafted IPv4 DHCP request packet being mishandled when endpoint analytics are enabled. An attacker could exploit this vulnerability by sending a crafted DHCP request through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: The attack vector is listed as network because a DHCP relay anywhere on the network could allow exploits from networks other than the adjacent one. Una vulnerabilidad en la función de espionaje DHCP del software Cisco IOS XE podría permitir que un atacante remoto no autenticado provoque que un dispositivo afectado se recargue inesperadamente, lo que resultaría en una condición de denegación de servicio (DoS). Esta vulnerabilidad se debe a que un paquete de solicitud DHCP IPv4 manipulado se maneja mal cuando el análisis de endpoints está habilitado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dhcp-dos-T3CXPO9z • CWE-122: Heap-based Buffer Overflow •
CVSS: 8.6EPSS: 0%CPEs: 373EXPL: 0CVE-2024-20311
https://notcve.org/view.php?id=CVE-2024-20311
A vulnerability in the Locator ID Separation Protocol (LISP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to the incorrect handling of LISP packets. An attacker could exploit this vulnerability by sending a crafted LISP packet to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. Note: This vulnerability could be exploited over either IPv4 or IPv6 transport. Una vulnerabilidad en la función del Protocolo de separación de ID del localizador (LISP) del software Cisco IOS y del software Cisco IOS XE podría permitir que un atacante remoto no autenticado provoque la recarga de un dispositivo afectado. Esta vulnerabilidad se debe al manejo incorrecto de los paquetes LISP. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lisp-3gYXs3qP • CWE-674: Uncontrolled Recursion •
CVSS: 5.8EPSS: 0%CPEs: 160EXPL: 0CVE-2024-20316
https://notcve.org/view.php?id=CVE-2024-20316
A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access resources that should have been protected by a configured IPv4 access control list (ACL). This vulnerability is due to improper handling of error conditions when a successfully authorized device administrator updates an IPv4 ACL using the NETCONF or RESTCONF protocol, and the update would reorder access control entries (ACEs) in the updated ACL. An attacker could exploit this vulnerability by accessing resources that should have been protected across an affected device. Una vulnerabilidad en los servicios de interfaz de modelo de datos (DMI) del software Cisco IOS XE podría permitir que un atacante remoto no autenticado acceda a recursos que deberían haber estado protegidos por una lista de control de acceso (ACL) IPv4 configurada. Esta vulnerabilidad se debe al manejo inadecuado de las condiciones de error cuando un administrador de dispositivo autorizado exitosamente actualiza una ACL IPv4 usando el protocolo NETCONF o RESTCONF, y la actualización reordenaría las entradas de control de acceso (ACE) en la ACL actualizada. Un atacante podría aprovechar esta vulnerabilidad accediendo a recursos que deberían haber estado protegidos en un dispositivo afectado. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dmi-acl-bypass-Xv8FO8Vz • CWE-390: Detection of Error Condition Without Action •
CVSS: 7.2EPSS: 7%CPEs: 127EXPL: 1CVE-2023-20273 – Cisco IOS XE Web UI Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2023-20273
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges. Una vulnerabilidad en la función de interfaz de usuario web del software Cisco IOS XE podría permitir que un atacante remoto autenticado inyecte comandos con privilegios de root. • https://github.com/smokeintheshell/CVE-2023-20273 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z/cvrf/cisco-sa-iosxe-webui-privesc-j22SaA4z_cvrf.xml https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting https://www.horizon3.ai/cisco-ios-xe- • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 88%CPEs: 4EXPL: 22CVE-2023-20198 – Cisco IOS XE Web UI Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2023-20198
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. • https://github.com/smokeintheshell/CVE-2023-20198 https://github.com/RevoltSecurities/CVE-2023-20198 https://github.com/Atea-Redteam/CVE-2023-20198 https://github.com/ZephrFish/CVE-2023-20198-Checker https://github.com/W01fh4cker/CVE-2023-20198-RCE https://github.com/Tounsi007/CVE-2023-20198 https://github.com/Shadow0ps/CVE-2023-20198-Scanner https://github.com/Pushkarup/CVE-2023-20198 https://github.com/sohaibeb/CVE-2023-20198 https://github.com/securityphoenix/cisco-CVE-2023-20 • CWE-420: Unprotected Alternate Channel •