DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Cisco IOS und IOS XE: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-09-24
Ein Angreifer kann mehrere Schwachstellen in Cisco IOS und Cisco IOS XE ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, einen Denial-of-Service-Zustand zu verursachen und beliebigen Code auszuführen – sogar mit Root-Rechten.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-20352US | —OT kritisch | KEV | ||
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following:
An authenticated, remote… | ||||
| CVE-2025-20338US | medium6.7 | — | ||
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underly… | ||||
| CVE-2025-20315US | — | — | ||
A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to… | ||||
| CVE-2025-20314US | — | — | ||
A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to an affected de… | ||||
| CVE-2025-20313US | — | — | ||
Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to th… | ||||
| CVE-2025-20312US | — | — | ||
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS)… | ||||
| CVE-2025-20240US | — | — | ||
A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS)… | ||||
| CVE-2025-20160US | — | — | ||
A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data… | ||||
| CVE-2025-20149US | — | — | ||
A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resultin… | ||||
| CVE-2025-20334US | — | — | ||
A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying opera… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Cisco Security Advisory cisco-sa-ios-cli-EB7cZ6yO vom 2025-09-24external
- Cisco Security Advisory cisco-sa-ios-tacacs-hdB7thJw vom 2025-09-24external
- Cisco Security Advisory cisco-sa-ios-xe-cmd-inject-rPJM8BGL vom 2025-09-24external
- Cisco Security Advisory cisco-sa-iosxe-arg-inject-EyDDbh4e vom 2025-09-24external
- Cisco Security Advisory cisco-sa-nbar-dos-LAvwTmeT vom 2025-09-24external
- Cisco Security Advisory cisco-sa-secboot-UqFD8AvC vom 2025-09-24external
- Cisco Security Advisory cisco-sa-snmp-x4LPhte vom 2025-09-24external
- Cisco Security Advisory cisco-sa-snmpwred-x3MJyf5M vom 2025-09-24external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan