IO
Product
IOS
On CISA KEVExploited in the wild
618
CVEs
39
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 134Medium 81Low 1
Watch
Add IOS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-1757 | 5.9 | Mar 28 | A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive… Affected: 2.3; 12.2(6)i1; 12.4(25e)jap1m; 12.4(25e)jap2; 12.4(25e)jap26; 12.4(25e)jaz1; +34 more |
| CVE-2018-0131 | 5.9 | Aug 14 | A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to obtain the… Affected: 15.5(3)s |
| CVE-2017-12228 | 5.9 | Sep 29 | A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to… Affected: 12.4(25e)jao3a; 12.4(25e)jao20s; 12.4(25e)jap1n; 12.4(25e)jap9; 15.0(2)ej; 15.0(2)ej1; +34 more |
| CVE-2011-4667 | 5.9 | Sep 25 | The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4-Port Multiservice… Affected: 12.2(33)sxi; 12.2(33)sxj; 15.2(1)t; 15.2(1)t1; 15.2(2)t |
| CVE-2017-3850 | 5.9 | Mar 21 | A vulnerability in the Autonomic Networking Infrastructure (ANI) feature of Cisco IOS Software (15.4 through 15.6) and Cisco IOS XE Software (3.7 through 3.18, and 16) could allow… Affected: 15.2(3)e; 15.2(3)e1; 15.2(3)e2; 15.2(3)e3; 15.2(4)e; 15.2(4)e1; +34 more |
| CVE-2016-6403 | 5.9 | Sep 18 | The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of service via a crafted… Affected: through 15.6\(1\)t |
| CVE-2024-20465 | 5.8 | Sep 25 | A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet 4000, 4010, and 5000 Series Switches could allow an… Affected: 15.2(8)e2; 15.2(8)e3; 15.2(8)e4; 15.2(8)e5 |
| CVE-2021-1377 | 5.8 | Mar 24 | A vulnerability in Address Resolution Protocol (ARP) management of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent an… Affected: 12.2(6)i1; 15.1(3)svr1; 15.1(3)svr2; 15.1(3)svr3; 15.1(3)svs; 15.1(3)svs1; +34 more |
| CVE-2020-3477 | 5.5 | Sep 24 | A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash: filesystem Affected: 16.3.11 |
| CVE-2018-0123 | 5.5 | Feb 8 | A Path Traversal vulnerability in the diagnostic shell for Cisco IOS and IOS XE Software could allow an authenticated, local attacker to use certain diagnostic shell commands that… Affected: 16.7(1) |
| CVE-2010-3049 | 5.5 | Sep 25 | Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot) Affected: through 12.2\(33\)sxh2 |
| CVE-2022-20724 | 5.3 | Apr 15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host… Affected: 15.2(5)e1; 15.2(5)e2c; 15.2(6)e0a; 15.2(6)e1; 15.2(6)e2a; 15.2(7)e; +34 more |
| CVE-2021-34705 | 5.3 | Sep 23 | A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass… Affected: 12.3(7)xm; 12.3(7)xr; 12.3(7)xr1; 12.3(7)xr2; 12.3(7)xr3; 12.3(7)xr4; +34 more |
| CVE-2020-3315 | 5.3 | May 6 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured file policies… Affected: 15.2(7)e |
| CVE-2017-12211 | 5.3 | Sep 7 | A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause high CPU… Affected: 3.16.1 |
| CVE-2017-6624 | 5.3 | May 3 | A vulnerability in Cisco IOS 15.5(3)M Software for Cisco CallManager Express (CME) could allow an unauthenticated, remote attacker to make unauthorized phone calls Affected: 15.5(3)m |
| CVE-2016-6398 | 5.3 | Sep 12 | The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier network communication… Affected: 15.5(3)m |
| CVE-2016-1459 | 5.3 | Jul 17 | Cisco IOS 12.4 and 15.0 through 15.5 and IOS XE 3.13 through 3.17 allow remote authenticated users to cause a denial of service (device reload) via crafted attributes in a BGP… Affected: 12.4(4)xc7; 12.4(15)t17; 12.4(19a); 12.4(22)yb2; 12.4(24)gc4; 12.4(24)gc5; +20 more |
| CVE-2016-1378 | 5.3 | Apr 14 | Cisco IOS before 15.2(2)E1 on Catalyst switches allows remote attackers to obtain potentially sensitive software-version information via a request to the Network Mobility Services… Affected: 15.1(1)sg; 15.1(1)sg1; 15.1(1)sg2; 15.1(1)sy; 15.1(1)sy1; 15.1(1)sy2; +22 more |
| CVE-2022-20725 | 4.8 | Apr 15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host… Affected: 15.2(5)e1; 15.2(5)e2c; 15.2(6)e0a; 15.2(6)e1; 15.2(6)e2a; 15.2(7)e; +34 more |
| CVE-2019-12668 | 4.8 | Sep 25 | A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS)… Affected: 15.2(2)e; 15.2(2)ea; 15.2(3)e; 15.2(3)ea; 15.2(4)e; 15.2(4)ea; +6 more |
| CVE-2025-20137 | 4.7 | May 7 | A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Switches could allow an… Affected: 15.2(5a)e; 15.2(5b)e; 15.2(5c)e; 15.2(6)e; 15.2(6)e0c; 15.2(6)e1; +29 more |
| CVE-2020-3231 | 4.7 | Jun 3 | A vulnerability in the 802.1X feature of Cisco Catalyst 2960-L Series Switches and Cisco Catalyst CDB-8P Switches could allow an unauthenticated, adjacent attacker to forward… Affected: 15.2(5)e2; 15.2(5)ex; 15.2(5a)e; 15.2(5b)e; 15.2(5c)e; 15.2(6)e; +16 more |
| CVE-2017-3803 | 4.7 | Jan 26 | A vulnerability in the Cisco IOS Software forwarding queue of Cisco 2960X and 3750X switches could allow an unauthenticated, adjacent attacker to cause a memory leak in the… Affected: 15.2(2)e3; 15.2(4)e1 |
| CVE-2022-20661 | 4.6 | Apr 15 | Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persistent code at boot… Affected: 15.2\(5\)ex before 15.2\(7\)e5; 15.2\(5\)ex before 15.2\(7\)e5; 15.2(8)e |
| CVE-2019-1762 | 4.4 | Mar 28 | A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system information on an affected… Affected: 12.2(6)i1; 15.1(2)sg8a; 15.1(3)svg3d; 15.1(3)svi1b; 15.1(3)svm3; 15.1(3)svn2; +25 more |
| CVE-2017-12289 | 4.4 | Oct 19 | A vulnerability in conditional, verbose debug logging for the IPsec feature of Cisco IOS XE Software could allow an authenticated, local attacker to display sensitive IPsec… Affected: through 16.7.1 |
| CVE-2019-1761 | 4.3 | Mar 28 | A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to receive potentially… Affected: 12.2(6)i1; 12.2(33)cx; 12.2(33)cy; 12.2(33)cy1; 12.2(33)cy2; 12.2(33)ira; +34 more |
| CVE-2019-1758 | 4.3 | Mar 28 | A vulnerability in 802.1x function of Cisco IOS Software on the Catalyst 6500 Series Switches could allow an unauthenticated, adjacent attacker to access the network prior to… Affected: 12.2(33)sxj6; 12.2(33)sxj7; 12.2(33)sxj8; 12.2(33)sxj9; 12.2(33)sxj10; 12.2(60)ez12; +34 more |
| CVE-2017-6770 | 4.2 | Aug 7 | Cisco IOS 12.0 through 15.6, Adaptive Security Appliance (ASA) Software 7.0.1 through 9.7.1.2, NX-OS 4.0 through 12.0, and IOS XE 3.6 through 3.18 are affected by a vulnerability… Affected: 12.0(1); 12.0(1)t; 12.0(1)xe; 12.0(1a); 12.0(2); 12.0(2)s; +34 more |
| CVE-1999-0524 | 4.0 | Aug 1 | ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts Affected: All versions, or not specified |
The 500 most important CVEs for this product (exploited first, then by severity)