iOS Xe vulnerabilities
116 known vulnerabilities in iOS Xe from Cisco. 113 are rated high or critical, and 27 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded…
A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerabilit
- 7.5 High severity
A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller…
A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improp
- 7.2 High severity
Cisco IOS: Improper Limitation of a Pathname to a Restricted Directory
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system
- 7.2 High severity
Cisco IOS: Improper Link Resolution Before File Access
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system
- 7.2 High severity
Cisco IOS: Improper Limitation of a Pathname to a Restricted Directory
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system
- 7.2 High severity
Cisco IOS: Improper Neutralization of Special Elements used in an OS Command
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system
- 8.6 High severity
Cisco IOS: Missing Release of Resource after Effective Lifetime
A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper resource management in the HTTP serv
- 7.2 High severity
Cisco IOS XE Software: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this v
- 8.6 High severity
Cisco IOS XE Software: Out-of-bounds Write
A vulnerability in the Application Visibility and Control (AVC-FNF) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected
- 8.6 High severity
Cisco IOS XE Software: NULL Pointer Dereference
A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS)
- 7.8 High severity
Cisco IOS XE Software: Incorrect Privilege Assignment
A vulnerability in the CLI of Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Cisco Catalyst 9000 Family Wireless Controllers could allow an authenticated, local attacker to elevate privileges to level 15 on an affected device. This vulnerabi
- 7.7 High severity
A vulnerability in the IPSec decryption routine of Cisco IOS XE Software could allow an…
A vulnerability in the IPSec decryption routine of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to buffer exhaustion tha
- 7.5 High severity
Cisco IOS XE Software: Improper Handling of Exceptional Conditions
A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of ce
- 8.0 High severity
Cisco IOS, XR, and XE Software Buffer Overflow Exploited
Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute
- 8.6 High severity
Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Exploited
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulne
- 8.6 High severity
Cisco IOS and IOS XE Software Improper Input Validation Exploited
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in
- 8.6 High severity
Cisco IOS and IOS XE Software Improper Input Validation Exploited
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulne
- 8.8 High severity
Cisco IOS, XR, and XE Software Buffer Overflow Exploited
Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) conditio
- 7.5 High severity
Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Exploited
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of servi
- 8.6 High severity
Cisco IOS and XE Software Internet Key Exchange Memory Leak Exploited
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (Do
- 7.5 High severity
Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Exploited
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due t
- 8.6 High severity
Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Exploited
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causin
- 9.8 Critical severity
Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Exploited
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. The vulne
- 5.9 Medium severity
Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Exploited
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or p
- 7.5 High severity
Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Exploited
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected
- 7.5 High severity
Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Exploited
A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and a
- 6.5 Medium severity
Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Exploited
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in a denial of service (DoS) condition. Mo
- 8.8 High severity
Cisco IOS and IOS XE Software SNMP Remote Code Execution Exploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
- 8.8 High severity
Cisco IOS and IOS XE Software SNMP Remote Code Execution Exploited
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected devi
- 8.8 High severity
Cisco IOS and IOS XE Software SNMP Remote Code Execution Exploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
- 8.8 High severity
Cisco IOS and IOS XE Software SNMP Remote Code Execution Exploited
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected devi
- 8.8 High severity
Cisco IOS and IOS XE Software SNMP Remote Code Execution Exploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
- 8.8 High severity
Cisco IOS and IOS XE Software SNMP Remote Code Execution Exploited
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected devi
- 8.8 High severity
Cisco IOS and IOS XE Software SNMP Remote Code Execution Exploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
- 9.8 Critical severity
Cisco IOS and IOS XE Remote Code Execution Exploited
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The
- 7.5 High severity
Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Exploited
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Assoc