IX
Network Security
IOS XE
On CISA KEVExploited in the wild
561
CVEs
27
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 20High 266Medium 158Low 1
Watch
Add IOS XE to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-34714 | 7.4 | Sep 23 | A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software, Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, and Cisco NX-OS… Affected: through 8.4\(3.115\); through 7.0\(3\)i7\(9\); through 7.3\(8\)n1\(1\); through 3.2\(3o\)a; through 4.1\(1a\)a |
| CVE-2021-1621 | 7.4 | Sep 23 | A vulnerability in the Layer 2 punt code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a queue wedge on an interface that receives specific… Affected: before 17.3.1; before 17.3.1; before 17.3.1; before 17.3.1; before 17.3.1 |
| CVE-2021-1403 | 7.4 | Mar 24 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking (CSWSH) attack and cause… Affected: 3.15.1xbs; 3.15.2xbs; 16.3.1; 16.3.1a; 16.3.2; 16.3.3; +34 more |
| CVE-2020-3512 | 7.4 | Sep 24 | A vulnerability in the PROFINET handler for Link Layer Discovery Protocol (LLDP) messages of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent… Affected: 15.2(7)e |
| CVE-2020-3511 | 7.4 | Sep 24 | A vulnerability in the ISDN subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device,… Affected: 15.1(4)m |
| CVE-2020-3508 | 7.4 | Sep 24 | A vulnerability in the IP Address Resolution Protocol (ARP) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers with a 20-Gbps Embedded… Affected: 16.3.1; 16.6.5; 16.7(1); 17.1.1; 16.9.1; 17.4.1 |
| CVE-2020-3497 | 7.4 | Sep 24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless… Affected: 16.12.1 |
| CVE-2020-3494 | 7.4 | Sep 24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless… Affected: 16.12.1 |
| CVE-2020-3493 | 7.4 | Sep 24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless… Affected: 16.12.1 |
| CVE-2020-3489 | 7.4 | Sep 24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless… Affected: 16.12.1 |
| CVE-2020-3488 | 7.4 | Sep 24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless… Affected: 16.12.1 |
| CVE-2020-3409 | 7.4 | Sep 24 | A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and… Affected: 15.2(7)e |
| CVE-2020-3390 | 7.4 | Sep 24 | A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of the Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000… Affected: 16.12.1 |
| CVE-2019-1750 | 7.4 | Mar 28 | A vulnerability in the Easy Virtual Switching System (VSS) of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, adjacent attacker to cause the… Affected: 3.6.0ae; 3.6.0be; 3.6.0e; 3.6.1e; 3.6.2ae; 3.6.2e; +34 more |
| CVE-2019-1749 | 7.4 | Mar 28 | A vulnerability in the ingress traffic validation of Cisco IOS XE Software for Cisco Aggregation Services Router (ASR) 900 Route Switch Processor 3 (RSP3) could allow an… Affected: 3.13.6as; 3.16.0as; 3.16.1as; 3.16.2as; 3.16.3as; 3.16.4bs; +34 more |
| CVE-2019-1748 | 7.4 | Mar 28 | A vulnerability in the Cisco Network Plug-and-Play (PnP) agent of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized… Affected: 3.3.0se; 3.3.0xo; 3.3.1se; 3.3.1xo; 3.3.2se; 3.3.2xo; +34 more |
| CVE-2018-15373 | 7.4 | Oct 5 | A vulnerability in the implementation of Cisco Discovery Protocol functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker… Affected: 15.5(3)s3.16 |
| CVE-2018-0475 | 7.4 | Oct 5 | A vulnerability in the implementation of the cluster feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial… Affected: 15.0(2.0.0) |
| CVE-2018-0471 | 7.4 | Oct 5 | A vulnerability in the Cisco Discovery Protocol (CDP) module of Cisco IOS XE Software Releases 16.6.1 and 16.6.2 could allow an unauthenticated, adjacent attacker to cause a… Affected: 16.6.1; 16.6.2 |
| CVE-2018-0165 | 7.4 | Mar 28 | A vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to… Affected: 15.2(3)e; denali-16.3.3 |
| CVE-2017-3849 | 7.4 | Mar 21 | A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS Software (possibly 15.2 through 15.6) and Cisco IOS XE Software (possibly 3.7… Affected: 3.7.0e; 3.7.1e; 3.7.2e; 3.7.3e; 3.7.4e; 3.7.5e; +34 more |
| CVE-2021-1432 | 7.3 | Mar 24 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the… Affected: 3.15.1xbs; 3.15.2xbs; 16.12.1; 16.12.1a; 16.12.1c; 16.12.1s; +19 more |
| CVE-2022-20851 | 7.2 | Sep 30 | Cisco IOS XE Software Web UI Command Injection Vulnerability Affected: 17.6.1 |
| CVE-2022-20723 | 7.2 | Apr 15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host… Affected: 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; 16.3.5; +34 more |
| CVE-2022-20720 | 7.2 | Apr 15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host… Affected: 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; 16.3.5; +34 more |
| CVE-2022-20719 | 7.2 | Apr 15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host… Affected: 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; 16.3.5; +34 more |
| CVE-2022-20718 | 7.2 | Apr 15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host… Affected: 16.3.1; 16.3.1a; 16.3.2; 16.3.3; 16.3.4; 16.3.5; +34 more |
| CVE-2022-20693 | 7.2 | Apr 15 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device Affected: 3.15.1xbs; 3.15.2xbs; 16.12.1; 16.12.1a; 16.12.1c; 16.12.1s; +34 more |
| CVE-2021-1443 | 7.2 | Mar 24 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying operating… Affected: 16.9.1; 16.9.1a; 16.9.1b; 16.9.1c; 16.9.1d; 16.9.1s; +34 more |
| CVE-2021-1435 | 7.2 | Mar 24 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user Affected: 16.9.1; 16.9.1a; 16.9.1b; 16.9.1c; 16.9.1d; 16.9.1s; +30 more |
| CVE-2021-1384 | 7.2 | Mar 24 | A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the underlying… Affected: before 16.6.9; 16.9.0 before 16.9.7; 17.3.2 before 17.3.3; 17.4.0 before 17.4.2; 17.5.0 |
| CVE-2020-3396 | 7.2 | Sep 24 | A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker to remove the USB 3.0… Affected: 16.12.1 |
| CVE-2020-3218 | 7.2 | Jun 3 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges… Affected: 16.6.1; 16.6.2; 16.6.3; 16.6.4; 16.6.4a; 16.6.4s; +34 more |
| CVE-2020-3212 | 7.2 | Jun 3 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating… Affected: 16.11.1; 16.11.1a; 16.11.1b; 16.11.1c; 16.11.1s; 16.12.1y |
| CVE-2020-3211 | 7.2 | Jun 3 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating… Affected: 16.10.1; 16.10.1a; 16.10.1b; 16.10.1e; 16.10.1s; 16.10.2; +10 more |
| CVE-2019-1862 | 7.2 | May 13 | A vulnerability in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell… Affected: 16.3.7 |
| CVE-2019-1756 | 7.2 | Mar 28 | A vulnerability in Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges Affected: 3.2.0ja; 16.7.1; 16.7.1a; 16.7.1b; 16.7.2; 16.7.3; +8 more |
| CVE-2019-1755 | 7.2 | Mar 28 | A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands… Affected: 3.2.0ja; 3.6.10e; 16.1.1; 16.1.2; 16.1.3; 16.2.1; +32 more |
| CVE-2012-0384 | 7.2 | Mar 29 | Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS before 3.1.2S, 3.2.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.1.xSG… Affected: 2.1; 2.1.0; 2.1.1; 2.1.2; 2.2; 2.2.1; +30 more |
| CVE-2023-20100 | 6.8 | Mar 23 | A vulnerability in the access point (AP) joining process of the Control and Provisioning of Wireless Access Points (CAPWAP) protocol of Cisco IOS XE Software for Wireless LAN… Affected: 17.10.1 |
| CVE-2023-20082 | 6.8 | Mar 23 | A vulnerability in Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches could allow an authenticated, local attacker with level-15 privileges or an unauthenticated… Affected: before 17.3.7; 17.4 before 17.6.5; 17.7 |
| CVE-2022-20944 | 6.8 | Oct 10 | Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2022-20694 | 6.8 | Apr 15 | A vulnerability in the implementation of the Resource Public Key Infrastructure (RPKI) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause… Affected: 3.7.0bs; 3.7.0s; 3.7.0xas; 3.7.0xbs; 3.7.1as; 3.7.1s; +34 more |
| CVE-2021-1453 | 6.8 | Mar 24 | A vulnerability in the software image verification functionality of Cisco IOS XE Software for the Cisco Catalyst 9000 Family of switches could allow an unauthenticated, physical… Affected: 3.15.1xbs; 3.15.2xbs; 16.6.1; 16.6.2; 16.6.3; 16.6.4; +34 more |
| CVE-2021-1398 | 6.8 | Mar 24 | A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker with physical… Affected: 3.7.0bs; 3.7.0s; 3.7.0xas; 3.7.0xbs; 3.7.1as; 3.7.1s; +34 more |
| CVE-2020-3220 | 6.8 | Jun 3 | A vulnerability in the hardware crypto driver of Cisco IOS XE Software for Cisco 4300 Series Integrated Services Routers and Cisco Catalyst 9800-L Wireless Controllers could allow… Affected: 16.4.1; 16.4.2; 16.4.3; 16.5.1; 16.5.1a; 16.5.1b; +34 more |
| CVE-2020-3209 | 6.8 | Jun 3 | A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute… Affected: 3.2.0se; 3.2.0sg; 3.2.1se; 3.2.1sg; 3.2.2se; 3.2.2sg; +34 more |
| CVE-2018-0282 | 6.8 | Jan 10 | A vulnerability in the TCP socket code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload Affected: All versions, or not specified |
| CVE-2018-15369 | 6.8 | Oct 5 | A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to… Affected: All versions, or not specified |
| CVE-2018-0469 | 6.8 | Oct 5 | A vulnerability in the web user interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload Affected: 16.5.1 |
The 500 most important CVEs for this product (exploited first, then by severity)