CVSS: 8.6EPSS: 0%CPEs: 19EXPL: 0CVE-2019-12654 – Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-12654
A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on an internal data structure. An attacker could exploit this vulnerability by sending a sequence of malicious SIP messages to an affected device. An exploit could allow the attacker to cause a NULL pointer dereference, resulting in a crash of the iosd process. This triggers a reload of the device. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sip-dos • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 31EXPL: 0CVE-2019-12671 – Cisco IOS XE Software Consent Token Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2019-12671
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS). The vulnerability is due to insufficient enforcement of the consent token in authorizing shell access. An attacker could exploit this vulnerability by authenticating to the CLI and requesting shell access on an affected device. A successful exploit could allow the attacker to gain shell access on the affected device and execute commands on the underlying OS. Una vulnerabilidad en la CLI del Software Cisco IOS XE, podría permitir a un atacante local autenticado conseguir acceso de shell en un dispositivo afectado y ejecutar comandos sobre el sistema operativo (SO) subyacente. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-ctbypass • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 8.6EPSS: 0%CPEs: 118EXPL: 0CVE-2019-12657 – Cisco IOS XE Software Unified Threat Defense Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-12657
A vulnerability in Unified Threat Defense (UTD) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper validation of IPv6 packets through the UTD feature. An attacker could exploit this vulnerability by sending IPv6 traffic through an affected device that is configured with UTD. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition. Una vulnerabilidad en Unified Threat Defense (UTD) en el Software Cisco IOS XE, podría permitir a un atacante remoto no autenticado causar que un dispositivo afectado se recargue. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-utd • CWE-20: Improper Input Validation •
CVSS: 8.6EPSS: 0%CPEs: 29EXPL: 0CVE-2019-12647 – Cisco IOS and IOS XE Software IP Ident Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-12647
A vulnerability in the Ident protocol handler of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability exists because the affected software incorrectly handles memory structures, leading to a NULL pointer dereference. An attacker could exploit this vulnerability by opening a TCP connection to specific ports and sending traffic over that connection. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. Una vulnerabilidad en el manejador del protocolo Ident de los Software Cisco IOS y IOS XE, podría permitir a un atacante remoto no autenticado causar la recarga de un dispositivo afectado. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-identd-dos • CWE-476: NULL Pointer Dereference •
CVSS: 10.0EPSS: 1%CPEs: 9EXPL: 0CVE-2019-12643 – Cisco REST API Container for IOS XE Software Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2019-12643
A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on the managed Cisco IOS XE device. The vulnerability is due to an improper check performed by the area of code that manages the REST API authentication service. An attacker could exploit this vulnerability by submitting malicious HTTP requests to the targeted device. A successful exploit could allow the attacker to obtain the token-id of an authenticated user. This token-id could be used to bypass authentication and execute privileged actions through the interface of the REST API virtual service container on the affected Cisco IOS XE device. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-iosxe-rest-auth-bypass • CWE-287: Improper Authentication •