CVSS: 7.7EPSS: 0%CPEs: 834EXPL: 0CVE-2021-34699 – Cisco IOS and IOS XE Software TrustSec CLI Parser Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2021-34699
A vulnerability in the TrustSec CLI parser of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to an improper interaction between the web UI and the CLI parser. An attacker could exploit this vulnerability by requesting a particular CLI command to be run through the web UI. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. Una vulnerabilidad en el analizador TrustSec CLI de Cisco IOS and Cisco IOS XE Software podría permitir a un atacante remoto y autenticado causar una recarga de un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-trustsec-dos-7fuXDR2 • CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities CWE-436: Interpretation Conflict •
CVSS: 5.8EPSS: 0%CPEs: 302EXPL: 0CVE-2021-1377 – Cisco IOS and IOS XE Software ARP Resource Management Exhaustion Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2021-1377
A vulnerability in Address Resolution Protocol (ARP) management of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent an affected device from resolving ARP entries for legitimate hosts on the connected subnets. This vulnerability exists because ARP entries are mismanaged. An attacker could exploit this vulnerability by continuously sending traffic that results in incomplete ARP entries. A successful exploit could allow the attacker to cause ARP requests on the device to be unsuccessful for legitimate hosts, resulting in a denial of service (DoS) condition. Una vulnerabilidad en la administración del Address Resolution Protocol (ARP) del Software Cisco IOS y el Software Cisco IOS XE, podría permitir a un atacante remoto no autenticado impedir que un dispositivo afectado resuelva entradas ARP para hosts legítimos en las subredes conectadas. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-arp-mtfhBfjE • CWE-399: Resource Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 57EXPL: 1CVE-2021-1385 – Cisco IOx Application Environment Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2021-1385
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticated, remote attacker to conduct directory traversal attacks and read and write files on the underlying operating system or host system. This vulnerability occurs because the device does not properly validate URIs in IOx API requests. An attacker could exploit this vulnerability by sending a crafted API request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system. Una vulnerabilidad en el entorno de alojamiento de aplicaciones Cisco IOx de varias plataformas Cisco, podría permitir a un atacante remoto autenticado llevar a cabo ataques de salto de directorio y leer y escribir archivos en el sistema operativo o host subyacente. • https://github.com/orangecertcc/security-research/security/advisories/GHSA-hhfw-6cm2-v3w5 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-pt-hWGcPf7g • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 134EXPL: 0CVE-2021-1391 – Cisco IOS and IOS XE Software Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-1391
A vulnerability in the dragonite debugger of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root privilege. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this vulnerability by bypassing the consent token mechanism with the residual scripts on the affected device. A successful exploit could allow the attacker to escalate from privilege level 15 to root privilege. Una vulnerabilidad en el depurador dragonite del Software Cisco IOS XE, podría permitir a un atacante local autenticado escalar del nivel de privilegio 15 al privilegio de root. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-FSM-Yj8qJbJc • CWE-489: Active Debug Code •
CVSS: 7.8EPSS: 0%CPEs: 214EXPL: 0CVE-2021-1392 – Cisco IOS and IOS XE Software Common Industrial Protocol Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-1392
A vulnerability in the CLI command permissions of Cisco IOS and Cisco IOS XE Software could allow an authenticated, local attacker to retrieve the password for Common Industrial Protocol (CIP) and then remotely configure the device as an administrative user. This vulnerability exists because incorrect permissions are associated with the show cip security CLI command. An attacker could exploit this vulnerability by issuing the command to retrieve the password for CIP on an affected device. A successful exploit could allow the attacker to reconfigure the device. Una vulnerabilidad en los permisos de comando de la CLI del Software Cisco IOS y Cisco IOS XE, podría permitir a un atacante local autenticado recuperar la contraseña para el Protocolo industrial común (CIP) y luego configurar remotamente el dispositivo como un usuario administrativo. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-XE-SAP-OPLbze68 • CWE-522: Insufficiently Protected Credentials •