Network Services Orchestrator vulnerabilities

6 known vulnerabilities in Network Services Orchestrator from Cisco. 6 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 10.0 Critical severity

  Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Exploited

  CVE-2025-32433Apr 16, 2025ErlangEPSS 98.9%

  Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protoco

• 8.8 High severity

  Cisco IOS XR Software: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-20655Nov 15, 2024Cisco

  A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected devi

• 8.8 High severity

  Cisco IOS XR Software: Improper Authorization

  CVE-2024-20381Sep 11, 2024Cisco

  A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authentic

• 7.8 High severity

  Cisco ConfD: Incorrect Privilege Assignment

  CVE-2024-20389May 16, 2024Cisco

  A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to i

• 7.8 High severity

  Cisco ConfD: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-20326May 16, 2024Cisco

  A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to i

• 7.8 High severity

  Cisco Network Services Orchestrator: Uncontrolled Search Path Element

  CVE-2024-20366May 15, 2024Cisco

  A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator (NSO) could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerabili