CVE-2026-20177
mediumpriority · track · 0EPSS 0.005 · 43 %ileUSEPSS · scored 2026-10-27
A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an unauthenticated, remote attacker to cause the device manager, SSH, or API to become inaccessible.This vulnerability is due to insufficient protection against management plane flooding attacks. An attacker could exploit this vulnerability by sending a high rate of ICMP, SSH, or HTTP traffic to an affected device. A successful exploit could allow the attacker to cause the CPU of the device to increase, resulting in a denial of service (DoS) condition on the device manager web GUI, SSH, or API. Data traffic through the device is not affected.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixed1.1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.7.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.8.0cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.8.1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.8.2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.9.1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.9.2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.9.2acisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.9.3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.9.4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - Fixed1.9.5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (13)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- cisco-sa-ie1k-uxq86LnxCisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability2026-08-19csaf · cisco_csafUS
A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an unauthenticated, remote attacker to cause the device manager, SSH, or API to become inaccessible. This vulnerability is due to insufficient protection against management plane flooding attacks. An attacker could exploit this vulnerability by sending a high rate of ICMP, SSH, or HTTP traffic to an affected device. A successful exploit could allow the attacker to cause the CPU of the device to increase, resulting in a denial of service (DoS) condition on the device manager web GUI, SSH, or API. Data traffic through the device is not affected. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan