asr_1013 Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/asr_1013/ Sun, 26 Feb 2023 06:41:10 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png asr_1013 Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/asr_1013/ 32 32 CVE-2020-3475 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-3475/ Sun, 26 Feb 2023 06:41:10 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-3475/ Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to gain unauthorized read access to sensitive data or cause the web management software to hang or crash, resulting in a denial of service (DoS) condition. For more information about these vulnerabilities, see the […]

The post CVE-2020-3475 appeared first on CVE Vulnerability.

]]> Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to gain unauthorized read access to sensitive data or cause the web management software to hang or crash, resulting in a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

The post CVE-2020-3475 appeared first on CVE Vulnerability.

]]> CVE-2020-3479 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-3479/ Sun, 26 Feb 2023 06:41:10 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-3479/ A vulnerability in the implementation of Multiprotocol Border Gateway Protocol (MP-BGP) for the Layer 2 VPN (L2VPN) Ethernet VPN (EVPN) address family in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of Border Gateway […]

The post CVE-2020-3479 appeared first on CVE Vulnerability.

]]> A vulnerability in the implementation of Multiprotocol Border Gateway Protocol (MP-BGP) for the Layer 2 VPN (L2VPN) Ethernet VPN (EVPN) address family in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of Border Gateway Protocol (BGP) update messages that contain crafted EVPN attributes. An attacker could exploit this vulnerability by sending BGP update messages with specific, malformed attributes to an affected device. A successful exploit could allow the attacker to cause an affected device to crash, resulting in a DoS condition.

The post CVE-2020-3479 appeared first on CVE Vulnerability.

]]> CVE-2020-3407 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-3407/ Sun, 26 Feb 2023 06:41:09 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-3407/ A vulnerability in the RESTCONF and NETCONF-YANG access control list (ACL) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of the ACL that is tied to the RESTCONF or NETCONF-YANG feature. An attacker could exploit this vulnerability by […]

The post CVE-2020-3407 appeared first on CVE Vulnerability.

]]> A vulnerability in the RESTCONF and NETCONF-YANG access control list (ACL) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of the ACL that is tied to the RESTCONF or NETCONF-YANG feature. An attacker could exploit this vulnerability by accessing the device using RESTCONF or NETCONF-YANG. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.

The post CVE-2020-3407 appeared first on CVE Vulnerability.

]]> CVE-2020-3408 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-3408/ Sun, 26 Feb 2023 06:41:09 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-3408/ A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability occurs because the regular expression (regex) engine that is used with the Split DNS feature of […]

The post CVE-2020-3408 appeared first on CVE Vulnerability.

]]> A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability occurs because the regular expression (regex) engine that is used with the Split DNS feature of affected releases may time out when it processes the DNS name list configuration. An attacker could exploit this vulnerability by trying to resolve an address or hostname that the affected device handles. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

The post CVE-2020-3408 appeared first on CVE Vulnerability.

]]> CVE-2020-3425 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-3425/ Sun, 26 Feb 2023 06:41:09 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-3425/ Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to the level of an Administrator user on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

The post CVE-2020-3425 appeared first on CVE Vulnerability.

]]> Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to the level of an Administrator user on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

The post CVE-2020-3425 appeared first on CVE Vulnerability.

]]> CVE-2019-16011 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-16011/ Sun, 26 Feb 2023 06:31:08 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-16011/ A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The […]

The post CVE-2019-16011 appeared first on CVE Vulnerability.

]]> A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges.

The post CVE-2019-16011 appeared first on CVE Vulnerability.

]]> CVE-2021-34724 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-34724/ Thu, 23 Feb 2023 14:10:20 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-34724/ A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to elevate privileges and execute arbitrary code on the underlying operating system as the root user. An attacker must be authenticated on an affected device as a PRIV15 user. This vulnerability is due to insufficient file system protection and […]

The post CVE-2021-34724 appeared first on CVE Vulnerability.

]]> A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to elevate privileges and execute arbitrary code on the underlying operating system as the root user. An attacker must be authenticated on an affected device as a PRIV15 user. This vulnerability is due to insufficient file system protection and the presence of a sensitive file in the bootflash directory on an affected device. An attacker could exploit this vulnerability by overwriting an installer file stored in the bootflash directory with arbitrary commands that can be executed with root-level privileges. A successful exploit could allow the attacker to read and write changes to the configuration database on the affected device.

The post CVE-2021-34724 appeared first on CVE Vulnerability.

]]> CVE-2021-34725 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-34725/ Thu, 23 Feb 2023 14:10:20 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-34725/ A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to an affected […]

The post CVE-2021-34725 appeared first on CVE Vulnerability.

]]> A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system. This vulnerability is due to insufficient input validation on certain CLI commands. An attacker could exploit this vulnerability by authenticating to an affected device and submitting crafted input to the CLI. The attacker must be authenticated as an administrative user to execute the affected commands. A successful exploit could allow the attacker to execute commands with root-level privileges.

The post CVE-2021-34725 appeared first on CVE Vulnerability.

]]> CVE-2021-34727 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-34727/ Thu, 23 Feb 2023 14:10:20 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-34727/ A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. This vulnerability is due to insufficient bounds checking when an affected device processes traffic. An attacker could exploit this vulnerability by sending crafted traffic to the device. A […]

The post CVE-2021-34727 appeared first on CVE Vulnerability.

]]> A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. This vulnerability is due to insufficient bounds checking when an affected device processes traffic. An attacker could exploit this vulnerability by sending crafted traffic to the device. A successful exploit could allow the attacker to cause a buffer overflow and possibly execute arbitrary commands with root-level privileges, or cause the device to reload, which could result in a denial of service condition.

The post CVE-2021-34727 appeared first on CVE Vulnerability.

]]> CVE-2021-1620 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-1620/ Thu, 23 Feb 2023 14:06:31 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-1620/ A vulnerability in the Internet Key Exchange Version 2 (IKEv2) support for the AutoReconnect feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to exhaust the free IP addresses from the assigned local pool. This vulnerability occurs because the code does not release the allocated IP address under […]

The post CVE-2021-1620 appeared first on CVE Vulnerability.

]]> A vulnerability in the Internet Key Exchange Version 2 (IKEv2) support for the AutoReconnect feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to exhaust the free IP addresses from the assigned local pool. This vulnerability occurs because the code does not release the allocated IP address under certain failure conditions. An attacker could exploit this vulnerability by trying to connect to the device with a non-AnyConnect client. A successful exploit could allow the attacker to exhaust the IP addresses from the assigned local pool, which prevents users from logging in and leads to a denial of service (DoS) condition.

The post CVE-2021-1620 appeared first on CVE Vulnerability.

]]>