Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-20115 (GCVE-0-2026-20115)
Vulnerability from cvelistv5 – Published: 2026-03-25 16:08 – Updated: 2026-03-25 17:41
VLAI?
EPSS
Summary
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.
This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.
Severity ?
6.1 (Medium)
CWE
- CWE-319 - Cleartext Transmission of Sensitive Information
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco IOS XE Software |
Affected:
17.14.1
Affected: 17.14.1a Affected: 17.15.1 Affected: 17.15.1w Affected: 17.15.1a Affected: 17.15.2 Affected: 17.15.1b Affected: 17.15.1x Affected: 17.15.1z Affected: 17.15.3 Affected: 17.15.2c Affected: 17.15.2a Affected: 17.15.1y Affected: 17.15.2b Affected: 17.15.3a Affected: 17.15.4 Affected: 17.15.3b Affected: 17.15.4d Affected: 17.15.4e Affected: 17.16.1 Affected: 17.16.1a Affected: 17.17.1 Affected: 17.18.1 Affected: 17.18.1w Affected: 17.18.1a |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20115",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T17:38:25.744053Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T17:41:48.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco IOS XE Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "17.14.1"
},
{
"status": "affected",
"version": "17.14.1a"
},
{
"status": "affected",
"version": "17.15.1"
},
{
"status": "affected",
"version": "17.15.1w"
},
{
"status": "affected",
"version": "17.15.1a"
},
{
"status": "affected",
"version": "17.15.2"
},
{
"status": "affected",
"version": "17.15.1b"
},
{
"status": "affected",
"version": "17.15.1x"
},
{
"status": "affected",
"version": "17.15.1z"
},
{
"status": "affected",
"version": "17.15.3"
},
{
"status": "affected",
"version": "17.15.2c"
},
{
"status": "affected",
"version": "17.15.2a"
},
{
"status": "affected",
"version": "17.15.1y"
},
{
"status": "affected",
"version": "17.15.2b"
},
{
"status": "affected",
"version": "17.15.3a"
},
{
"status": "affected",
"version": "17.15.4"
},
{
"status": "affected",
"version": "17.15.3b"
},
{
"status": "affected",
"version": "17.15.4d"
},
{
"status": "affected",
"version": "17.15.4e"
},
{
"status": "affected",
"version": "17.16.1"
},
{
"status": "affected",
"version": "17.16.1a"
},
{
"status": "affected",
"version": "17.17.1"
},
{
"status": "affected",
"version": "17.18.1"
},
{
"status": "affected",
"version": "17.18.1w"
},
{
"status": "affected",
"version": "17.18.1a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.\r\n\r This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T16:08:01.917Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-iosxe_infodis-6J847uEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB"
}
],
"source": {
"advisory": "cisco-sa-iosxe_infodis-6J847uEB",
"defects": [
"CSCwp83554"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20115",
"datePublished": "2026-03-25T16:08:01.917Z",
"dateReserved": "2025-10-08T11:59:15.376Z",
"dateUpdated": "2026-03-25T17:41:48.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-20115",
"date": "2026-05-18",
"epss": "0.00016",
"percentile": "0.03873"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-20115\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2026-03-25T16:16:16.533\",\"lastModified\":\"2026-03-26T15:13:15.790\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.\\r\\n\\r This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-319\"}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB\",\"source\":\"psirt@cisco.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-20115\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-25T17:38:25.744053Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-25T17:41:23.488Z\"}}], \"cna\": {\"source\": {\"defects\": [\"CSCwp83554\"], \"advisory\": \"cisco-sa-iosxe_infodis-6J847uEB\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco IOS XE Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"17.14.1\"}, {\"status\": \"affected\", \"version\": \"17.14.1a\"}, {\"status\": \"affected\", \"version\": \"17.15.1\"}, {\"status\": \"affected\", \"version\": \"17.15.1w\"}, {\"status\": \"affected\", \"version\": \"17.15.1a\"}, {\"status\": \"affected\", \"version\": \"17.15.2\"}, {\"status\": \"affected\", \"version\": \"17.15.1b\"}, {\"status\": \"affected\", \"version\": \"17.15.1x\"}, {\"status\": \"affected\", \"version\": \"17.15.1z\"}, {\"status\": \"affected\", \"version\": \"17.15.3\"}, {\"status\": \"affected\", \"version\": \"17.15.2c\"}, {\"status\": \"affected\", \"version\": \"17.15.2a\"}, {\"status\": \"affected\", \"version\": \"17.15.1y\"}, {\"status\": \"affected\", \"version\": \"17.15.2b\"}, {\"status\": \"affected\", \"version\": \"17.15.3a\"}, {\"status\": \"affected\", \"version\": \"17.15.4\"}, {\"status\": \"affected\", \"version\": \"17.15.3b\"}, {\"status\": \"affected\", \"version\": \"17.15.4d\"}, {\"status\": \"affected\", \"version\": \"17.15.4e\"}, {\"status\": \"affected\", \"version\": \"17.16.1\"}, {\"status\": \"affected\", \"version\": \"17.16.1a\"}, {\"status\": \"affected\", \"version\": \"17.17.1\"}, {\"status\": \"affected\", \"version\": \"17.18.1\"}, {\"status\": \"affected\", \"version\": \"17.18.1w\"}, {\"status\": \"affected\", \"version\": \"17.18.1a\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB\", \"name\": \"cisco-sa-iosxe_infodis-6J847uEB\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.\\r\\n\\r This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-319\", \"description\": \"Cleartext Transmission of Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2026-03-25T16:08:01.917Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-20115\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-25T17:41:48.709Z\", \"dateReserved\": \"2025-10-08T11:59:15.376Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2026-03-25T16:08:01.917Z\", \"assignerShortName\": \"cisco\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
NCSC-2026-0104
Vulnerability from csaf_ncscnl - Published: 2026-03-26 09:50 - Updated: 2026-03-26 09:50Summary
Kwetsbaarheden verholpen in Cisco IOS XE Software
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Cisco heeft kwetsbaarheden verholpen in Cisco IOS XE Software, specifiek voor verschillende producten zoals Catalyst 9000 Series Switches, Catalyst CW9800 Family, en Cisco Meraki.
Interpretaties: De kwetsbaarheden omvatten verschillende problemen, zoals een geheugenlek in de IKEv2-implementatie, kwetsbaarheden in de DHCP-snooping functie, en onjuiste verwerking van CAPWAP-pakketten die leiden tot een denial of service. Daarnaast zijn er kwetsbaarheden gerapporteerd die het mogelijk maken voor ongeauthenticeerde aanvallers om toegang te krijgen tot gevoelige apparaatconfiguraties en om privileges te verhogen via de Lobby Ambassador API. Ook zijn er problemen met onjuiste privilege-toewijzingen en een kritieke kwetsbaarheid in de bootloader die lokale of fysieke toegang vereisen voor exploitatie. De SCP-serverfunctie is ook kwetsbaar voor denial of service door onjuiste verwerking van SCP-verzoeken.
Oplossingen: Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-124: Buffer Underwrite ('Buffer Underflow')
CWE-228: Improper Handling of Syntactically Invalid Structure
CWE-230: Improper Handling of Missing Values
CWE-235: Improper Handling of Extra Parameters
CWE-266: Incorrect Privilege Assignment
CWE-319: Cleartext Transmission of Sensitive Information
CWE-400: Uncontrolled Resource Consumption
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-771: Missing Reference to Active Allocated Resource
CWE-1286: Improper Validation of Syntactic Correctness of Input
A vulnerability in the IKEv2 feature of multiple Cisco software products allows an unauthenticated remote attacker to cause a memory leak resulting in denial of service, necessitating a manual reboot to restore service.
8.6 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE's DHCP snooping feature on Catalyst 9000 Series Switches allows unauthenticated remote attackers to forward BOOTP packets between VLANs, causing VLAN leakage, high CPU usage, and denial of service.
8.6 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family allows unauthenticated remote attackers to cause denial of service by sending malformed CAPWAP packets, resulting in device reloads.
8.6 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in the TLS library of Cisco IOS XE Software allows an unauthenticated, adjacent attacker to exhaust device memory during TLS connection setup due to improper memory management, potentially causing denial of service.
7.4 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE Software for Cisco Meraki allows remote, unauthenticated attackers to access confidential device information by exploiting insecure device configuration uploads via an on-path attack.
6.1 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
An authenticated remote attacker can exploit a vulnerability in the HTTP Server feature of Cisco IOS and IOS XE Software Release 3E by sending malformed HTTP requests, causing an unexpected device reload and denial of service.
7.7 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE's Lobby Ambassador web-based management API allows authenticated remote attackers to elevate privileges by exploiting insufficient parameter validation, potentially creating new users with elevated access.
5.4 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE CLI allows an authenticated local attacker to cause a denial of service by exploiting incorrect privileges on the start maintenance command, which puts the device into maintenance mode and shuts down interfaces.
6.5 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A bootloader vulnerability in Cisco IOS XE Software for Cisco Catalyst 9200 Series and Rugged Series Switches allows local attackers to execute arbitrary code at boot time, bypassing integrity checks and signed image requirements.
6.1 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in the SCP server feature of Cisco IOS XE Software allows an authenticated local attacker with low privileges to cause a denial of service by sending a malformed SCP request via SSH, potentially causing device reloads.
6.5 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
References
21 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Cisco heeft kwetsbaarheden verholpen in Cisco IOS XE Software, specifiek voor verschillende producten zoals Catalyst 9000 Series Switches, Catalyst CW9800 Family, en Cisco Meraki.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden omvatten verschillende problemen, zoals een geheugenlek in de IKEv2-implementatie, kwetsbaarheden in de DHCP-snooping functie, en onjuiste verwerking van CAPWAP-pakketten die leiden tot een denial of service. Daarnaast zijn er kwetsbaarheden gerapporteerd die het mogelijk maken voor ongeauthenticeerde aanvallers om toegang te krijgen tot gevoelige apparaatconfiguraties en om privileges te verhogen via de Lobby Ambassador API. Ook zijn er problemen met onjuiste privilege-toewijzingen en een kritieke kwetsbaarheid in de bootloader die lokale of fysieke toegang vereisen voor exploitatie. De SCP-serverfunctie is ook kwetsbaar voor denial of service door onjuiste verwerking van SCP-verzoeken.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Buffer Underwrite (\u0027Buffer Underflow\u0027)",
"title": "CWE-124"
},
{
"category": "general",
"text": "Improper Handling of Syntactically Invalid Structure",
"title": "CWE-228"
},
{
"category": "general",
"text": "Improper Handling of Missing Values",
"title": "CWE-230"
},
{
"category": "general",
"text": "Improper Handling of Extra Parameters",
"title": "CWE-235"
},
{
"category": "general",
"text": "Incorrect Privilege Assignment",
"title": "CWE-266"
},
{
"category": "general",
"text": "Cleartext Transmission of Sensitive Information",
"title": "CWE-319"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "general",
"text": "Missing Reference to Active Allocated Resource",
"title": "CWE-771"
},
{
"category": "general",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-ios-dos-kPEpQGGK"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bootp-WuBhNBxA"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-http-dos-sbv8XRpL"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-dhcpsn-dos-xBn8Mtks#fs"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-lobby-privesc-KwxBqJy"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-mntc-dos-LZweQcyq"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-tls-dos-TVgLDEZL"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-scp-dos-duAdXtCg"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-dos-hnX5KGOm"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-secureboot-bypass-B6uYxYSZ"
}
],
"title": "Kwetsbaarheden verholpen in Cisco IOS XE Software",
"tracking": {
"current_release_date": "2026-03-26T09:50:03.269095Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0104",
"initial_release_date": "2026-03-26T09:50:03.269095Z",
"revision_history": [
{
"date": "2026-03-26T09:50:03.269095Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Cisco 3000 Series Industrial Security Appliances (ISA)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Cisco ASA 5500-X Series Firewalls"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Cisco Adaptive Security Virtual Appliance (ASAv)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Cisco Firepower 1000 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Cisco Firepower 2100 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Cisco Firepower 9000 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "Cisco IOS XE Software"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "Cisco Secure Firewall 3100 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "Cisco Secure Firewall 4200 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "Cisco Secure Firewall Threat Defense (FTD) Software"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "IOS"
}
],
"category": "vendor",
"name": "Cisco"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-20012",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "description",
"text": "A vulnerability in the IKEv2 feature of multiple Cisco software products allows an unauthenticated remote attacker to cause a memory leak resulting in denial of service, necessitating a manual reboot to restore service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20012 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20012.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20012"
},
{
"cve": "CVE-2026-20084",
"notes": [
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE\u0027s DHCP snooping feature on Catalyst 9000 Series Switches allows unauthenticated remote attackers to forward BOOTP packets between VLANs, causing VLAN leakage, high CPU usage, and denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20084 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20084.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20084"
},
{
"cve": "CVE-2026-20086",
"cwe": {
"id": "CWE-230",
"name": "Improper Handling of Missing Values"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Missing Values",
"title": "CWE-230"
},
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family allows unauthenticated remote attackers to cause denial of service by sending malformed CAPWAP packets, resulting in device reloads.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20086 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20086.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20086"
},
{
"cve": "CVE-2026-20004",
"cwe": {
"id": "CWE-771",
"name": "Missing Reference to Active Allocated Resource"
},
"notes": [
{
"category": "other",
"text": "Missing Reference to Active Allocated Resource",
"title": "CWE-771"
},
{
"category": "description",
"text": "A vulnerability in the TLS library of Cisco IOS XE Software allows an unauthenticated, adjacent attacker to exhaust device memory during TLS connection setup due to improper memory management, potentially causing denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20004 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20004.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20004"
},
{
"cve": "CVE-2026-20115",
"cwe": {
"id": "CWE-319",
"name": "Cleartext Transmission of Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Cleartext Transmission of Sensitive Information",
"title": "CWE-319"
},
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE Software for Cisco Meraki allows remote, unauthenticated attackers to access confidential device information by exploiting insecure device configuration uploads via an on-path attack.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20115 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20115.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20115"
},
{
"cve": "CVE-2026-20125",
"cwe": {
"id": "CWE-228",
"name": "Improper Handling of Syntactically Invalid Structure"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Syntactically Invalid Structure",
"title": "CWE-228"
},
{
"category": "description",
"text": "An authenticated remote attacker can exploit a vulnerability in the HTTP Server feature of Cisco IOS and IOS XE Software Release 3E by sending malformed HTTP requests, causing an unexpected device reload and denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20125 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20125.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20125"
},
{
"cve": "CVE-2026-20114",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
},
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE\u0027s Lobby Ambassador web-based management API allows authenticated remote attackers to elevate privileges by exploiting insufficient parameter validation, potentially creating new users with elevated access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20114 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20114.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20114"
},
{
"cve": "CVE-2026-20110",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"notes": [
{
"category": "other",
"text": "Incorrect Privilege Assignment",
"title": "CWE-266"
},
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE CLI allows an authenticated local attacker to cause a denial of service by exploiting incorrect privileges on the start maintenance command, which puts the device into maintenance mode and shuts down interfaces.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20110 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20110.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20110"
},
{
"cve": "CVE-2026-20104",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"notes": [
{
"category": "other",
"text": "Buffer Underwrite (\u0027Buffer Underflow\u0027)",
"title": "CWE-124"
},
{
"category": "description",
"text": "A bootloader vulnerability in Cisco IOS XE Software for Cisco Catalyst 9200 Series and Rugged Series Switches allows local attackers to execute arbitrary code at boot time, bypassing integrity checks and signed image requirements.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20104 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20104.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20104"
},
{
"cve": "CVE-2026-20083",
"cwe": {
"id": "CWE-235",
"name": "Improper Handling of Extra Parameters"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Extra Parameters",
"title": "CWE-235"
},
{
"category": "description",
"text": "A vulnerability in the SCP server feature of Cisco IOS XE Software allows an authenticated local attacker with low privileges to cause a denial of service by sending a malformed SCP request via SSH, potentially causing device reloads.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20083 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20083.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20083"
}
]
}
CISCO-SA-IOSXE_INFODIS-6J847UEB
Vulnerability from csaf_cisco - Published: 2026-03-25 16:00 - Updated: 2026-03-25 16:00Summary
Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability
Notes
Summary: A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.
This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is part of the March 2026 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75297"].
Vulnerable Products: At the time of publication, this vulnerability affected the following Cisco platforms if they were running a vulnerable release of Cisco IOS XE Software and had Meraki dashboard management enabled:
Catalyst 9200 Series Switches
Catalyst 9300 Series Switches
Catalyst CW9800H1 Wireless Controllers
Meraki MS390
For information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.
Determine the Device Configuration
To determine whether the device is configured for a Meraki tunnel to the dashboard, use the show meraki connect brief CLI command. If the device is configured for a Meraki tunnel, this command will return output showing that the tunnel is Connected, Up, and Registered, as shown in the following example:
Switch# show meraki connect brief
Meraki Cloud: https://n143.meraki.com
Status: Connected
Tunnel: Up
Registration: Registered
Products Confirmed Not Vulnerable: Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following Cisco products:
IOS Software
IOS XR Software
NX-OS Software
Workarounds: There are no workarounds that address this vulnerability.
Fixed Software: Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
Cisco IOS and IOS XE Software
To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"]. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (“Combined First Fixed”).
To use the tool, go to the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"] page and follow the instructions. Alternatively, use the following form to determine whether a release is affected by any Cisco Security Advisory. To use the form, follow these steps:
Choose which advisories the tool will search—only this advisory, only advisories with a Critical or High Security Impact Rating (SIR) ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#asr"], or all advisories.
Enter a release number—for example, 15.9(3)M2 or 17.3.3.
Click Check.
Only this advisory All Critical and High advisories All advisories
Vulnerability Policy: To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
Exploitation and Public Announcements: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
Source: This vulnerability was found during internal security testing.
Legal Disclaimer: SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT
The Cisco Support and Downloads ["https://www.cisco.com/c/en/us/support/index.html"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
When considering software upgrades ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"], customers are advised to regularly consult the advisories ["https://www.cisco.com/go/psirt"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"] or their contracted maintenance providers.
LEGAL DISCLAIMER DETAILS
CISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
Copies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories ["https://www.cisco.com/go/psirt"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"] for more information.
6.1 (Medium)
Affected products
Known affected
28 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
17.14.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.16.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.14.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1w
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.17.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1x
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1z
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.16.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.2c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.2a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1y
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.18.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.2b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.3a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.3b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.18.1w
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.18.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4s1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4d
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
References
10 references
Acknowledgments
{
"document": {
"acknowledgments": [
{
"summary": "This vulnerability was found during internal security testing."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"notes": [
{
"category": "summary",
"text": "A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.\r\n\r\nThis vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\n\r\n\r\nThis advisory is part of the March 2026 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [\"https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75297\"].",
"title": "Summary"
},
{
"category": "general",
"text": "At the time of publication, this vulnerability affected the following Cisco platforms if they were running a vulnerable release of Cisco IOS XE Software and had Meraki dashboard management enabled:\r\n\r\nCatalyst 9200 Series Switches\r\nCatalyst 9300 Series Switches\r\nCatalyst CW9800H1 Wireless Controllers\r\nMeraki MS390\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software [\"#fs\"] section of this advisory.\r\n Determine the Device Configuration\r\nTo determine whether the device is configured for a Meraki tunnel to the dashboard, use the show meraki connect brief CLI command. If the device is configured for a Meraki tunnel, this command will return output showing that the tunnel is Connected, Up, and Registered, as shown in the following example:\r\n\r\n\r\nSwitch# show meraki connect brief\r\nMeraki Cloud: https://n143.meraki.com\r\nStatus: Connected\r\nTunnel: Up\r\nRegistration: Registered",
"title": "Vulnerable Products"
},
{
"category": "general",
"text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nIOS Software\r\nIOS XR Software\r\nNX-OS Software",
"title": "Products Confirmed Not Vulnerable"
},
{
"category": "general",
"text": "There are no workarounds that address this vulnerability.",
"title": "Workarounds"
},
{
"category": "general",
"text": "Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.\r\n Cisco IOS and IOS XE Software\r\nTo help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker [\"https://sec.cloudapps.cisco.com/security/center/softwarechecker.x\"]. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (\u201cFirst Fixed\u201d). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (\u201cCombined First Fixed\u201d).\r\n\r\nTo use the tool, go to the Cisco Software Checker [\"https://sec.cloudapps.cisco.com/security/center/softwarechecker.x\"] page and follow the instructions. Alternatively, use the following form to determine whether a release is affected by any Cisco Security Advisory. To use the form, follow these steps:\r\n\r\nChoose which advisories the tool will search\u2014only this advisory, only advisories with a Critical or High Security Impact Rating (SIR) [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#asr\"], or all advisories.\r\nEnter a release number\u2014for example, 15.9(3)M2 or 17.3.3.\r\nClick Check.\r\n\r\n Only this advisory All Critical and High advisories All advisories",
"title": "Fixed Software"
},
{
"category": "general",
"text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
"title": "Vulnerability Policy"
},
{
"category": "general",
"text": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.",
"title": "Exploitation and Public Announcements"
},
{
"category": "general",
"text": "This vulnerability was found during internal security testing.",
"title": "Source"
},
{
"category": "legal_disclaimer",
"text": "SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT\r\n\r\nThe Cisco Support and Downloads [\"https://www.cisco.com/c/en/us/support/index.html\"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.\r\n\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories [\"https://www.cisco.com/go/psirt\"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"] or their contracted maintenance providers.\r\n LEGAL DISCLAIMER DETAILS\r\n\r\nCISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nCopies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] for more information.",
"title": "Legal Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@cisco.com",
"issuing_authority": "Cisco PSIRT",
"name": "Cisco",
"namespace": "https://wwww.cisco.com"
},
"references": [
{
"category": "self",
"summary": "Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB"
},
{
"category": "external",
"summary": "Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication",
"url": "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75297"
},
{
"category": "external",
"summary": "Cisco Security Vulnerability Policy",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
},
{
"category": "external",
"summary": "Cisco Software Checker",
"url": "https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"
},
{
"category": "external",
"summary": "Security Impact Rating (SIR)",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#asr"
},
{
"category": "external",
"summary": "Security Vulnerability Policy",
"url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
},
{
"category": "external",
"summary": "Cisco Support and Downloads",
"url": "https://www.cisco.com/c/en/us/support/index.html"
},
{
"category": "external",
"summary": "Cisco Technical Assistance Center (TAC)",
"url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
},
{
"category": "external",
"summary": "considering software upgrades",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
},
{
"category": "external",
"summary": "the advisories",
"url": "https://www.cisco.com/go/psirt"
}
],
"title": "Cisco IOS XE Software Secure Channel for Meraki Information Disclosure Vulnerability",
"tracking": {
"current_release_date": "2026-03-25T16:00:00+00:00",
"generator": {
"date": "2026-03-27T21:13:25+00:00",
"engine": {
"name": "TVCE"
}
},
"id": "cisco-sa-iosxe_infodis-6J847uEB",
"initial_release_date": "2026-03-25T16:00:00+00:00",
"revision_history": [
{
"date": "2026-03-25T15:51:08+00:00",
"number": "1.0.0",
"summary": "Initial public release."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "service_pack",
"name": "17.14.1",
"product": {
"name": "17.14.1",
"product_id": "CSAFPID-295361"
}
},
{
"category": "service_pack",
"name": "17.14.1a",
"product": {
"name": "17.14.1a",
"product_id": "CSAFPID-301611"
}
}
],
"category": "product_version",
"name": "17.14"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.15.1",
"product": {
"name": "17.15.1",
"product_id": "CSAFPID-300938"
}
},
{
"category": "service_pack",
"name": "17.15.1w",
"product": {
"name": "17.15.1w",
"product_id": "CSAFPID-301759"
}
},
{
"category": "service_pack",
"name": "17.15.1a",
"product": {
"name": "17.15.1a",
"product_id": "CSAFPID-302682"
}
},
{
"category": "service_pack",
"name": "17.15.2",
"product": {
"name": "17.15.2",
"product_id": "CSAFPID-302782"
}
},
{
"category": "service_pack",
"name": "17.15.1b",
"product": {
"name": "17.15.1b",
"product_id": "CSAFPID-302808"
}
},
{
"category": "service_pack",
"name": "17.15.1x",
"product": {
"name": "17.15.1x",
"product_id": "CSAFPID-302851"
}
},
{
"category": "service_pack",
"name": "17.15.1z",
"product": {
"name": "17.15.1z",
"product_id": "CSAFPID-302893"
}
},
{
"category": "service_pack",
"name": "17.15.3",
"product": {
"name": "17.15.3",
"product_id": "CSAFPID-303045"
}
},
{
"category": "service_pack",
"name": "17.15.2c",
"product": {
"name": "17.15.2c",
"product_id": "CSAFPID-303212"
}
},
{
"category": "service_pack",
"name": "17.15.2a",
"product": {
"name": "17.15.2a",
"product_id": "CSAFPID-303213"
}
},
{
"category": "service_pack",
"name": "17.15.1y",
"product": {
"name": "17.15.1y",
"product_id": "CSAFPID-303214"
}
},
{
"category": "service_pack",
"name": "17.15.2b",
"product": {
"name": "17.15.2b",
"product_id": "CSAFPID-303311"
}
},
{
"category": "service_pack",
"name": "17.15.3a",
"product": {
"name": "17.15.3a",
"product_id": "CSAFPID-304866"
}
},
{
"category": "service_pack",
"name": "17.15.4",
"product": {
"name": "17.15.4",
"product_id": "CSAFPID-305238"
}
},
{
"category": "service_pack",
"name": "17.15.3b",
"product": {
"name": "17.15.3b",
"product_id": "CSAFPID-305275"
}
},
{
"category": "service_pack",
"name": "17.15.4a",
"product": {
"name": "17.15.4a",
"product_id": "CSAFPID-306558"
}
},
{
"category": "service_pack",
"name": "17.15.4b",
"product": {
"name": "17.15.4b",
"product_id": "CSAFPID-306610"
}
},
{
"category": "service_pack",
"name": "17.15.4c",
"product": {
"name": "17.15.4c",
"product_id": "CSAFPID-306648"
}
},
{
"category": "service_pack",
"name": "17.15.4s1",
"product": {
"name": "17.15.4s1",
"product_id": "CSAFPID-306814"
}
},
{
"category": "service_pack",
"name": "17.15.4d",
"product": {
"name": "17.15.4d",
"product_id": "CSAFPID-306891"
}
}
],
"category": "product_version",
"name": "17.15"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.16.1",
"product": {
"name": "17.16.1",
"product_id": "CSAFPID-301219"
}
},
{
"category": "service_pack",
"name": "17.16.1a",
"product": {
"name": "17.16.1a",
"product_id": "CSAFPID-302979"
}
}
],
"category": "product_version",
"name": "17.16"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.17.1",
"product": {
"name": "17.17.1",
"product_id": "CSAFPID-302626"
}
}
],
"category": "product_version",
"name": "17.17"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.18.1",
"product": {
"name": "17.18.1",
"product_id": "CSAFPID-303216"
}
},
{
"category": "service_pack",
"name": "17.18.1w",
"product": {
"name": "17.18.1w",
"product_id": "CSAFPID-305277"
}
},
{
"category": "service_pack",
"name": "17.18.1a",
"product": {
"name": "17.18.1a",
"product_id": "CSAFPID-306557"
}
}
],
"category": "product_version",
"name": "17.18"
}
],
"category": "product_family",
"name": "Cisco IOS XE Software"
}
],
"category": "vendor",
"name": "Cisco"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-20115",
"ids": [
{
"system_name": "Cisco Bug ID",
"text": "CSCwp83554"
}
],
"notes": [
{
"category": "other",
"text": "Complete.",
"title": "Affected Product Comprehensiveness"
}
],
"product_status": {
"known_affected": [
"CSAFPID-295361",
"CSAFPID-300938",
"CSAFPID-301219",
"CSAFPID-301611",
"CSAFPID-301759",
"CSAFPID-302626",
"CSAFPID-302682",
"CSAFPID-302782",
"CSAFPID-302808",
"CSAFPID-302851",
"CSAFPID-302893",
"CSAFPID-302979",
"CSAFPID-303045",
"CSAFPID-303212",
"CSAFPID-303213",
"CSAFPID-303214",
"CSAFPID-303216",
"CSAFPID-303311",
"CSAFPID-304866",
"CSAFPID-305238",
"CSAFPID-305275",
"CSAFPID-305277",
"CSAFPID-306557",
"CSAFPID-306558",
"CSAFPID-306610",
"CSAFPID-306648",
"CSAFPID-306814",
"CSAFPID-306891"
]
},
"release_date": "2026-03-25T16:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Cisco has released software updates that address this vulnerability.",
"product_ids": [
"CSAFPID-295361",
"CSAFPID-300938",
"CSAFPID-301219",
"CSAFPID-301611",
"CSAFPID-301759",
"CSAFPID-302626",
"CSAFPID-302682",
"CSAFPID-302782",
"CSAFPID-302808",
"CSAFPID-302851",
"CSAFPID-302893",
"CSAFPID-302979",
"CSAFPID-303045",
"CSAFPID-303212",
"CSAFPID-303213",
"CSAFPID-303214",
"CSAFPID-303216",
"CSAFPID-303311",
"CSAFPID-304866",
"CSAFPID-305238",
"CSAFPID-305275",
"CSAFPID-305277",
"CSAFPID-306557",
"CSAFPID-306558",
"CSAFPID-306610",
"CSAFPID-306648",
"CSAFPID-306814",
"CSAFPID-306891"
],
"url": "https://software.cisco.com"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-295361",
"CSAFPID-300938",
"CSAFPID-301219",
"CSAFPID-301611",
"CSAFPID-301759",
"CSAFPID-302626",
"CSAFPID-302682",
"CSAFPID-302782",
"CSAFPID-302808",
"CSAFPID-302851",
"CSAFPID-302893",
"CSAFPID-302979",
"CSAFPID-303045",
"CSAFPID-303212",
"CSAFPID-303213",
"CSAFPID-303214",
"CSAFPID-303216",
"CSAFPID-303311",
"CSAFPID-304866",
"CSAFPID-305238",
"CSAFPID-305275",
"CSAFPID-305277",
"CSAFPID-306557",
"CSAFPID-306558",
"CSAFPID-306610",
"CSAFPID-306648",
"CSAFPID-306814",
"CSAFPID-306891"
]
}
],
"title": "Remove insecure flag"
}
]
}
GHSA-XM4H-9VF3-J26J
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-25 18:31
VLAI?
Details
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.
This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.
Severity ?
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-20115"
],
"database_specific": {
"cwe_ids": [
"CWE-319"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T16:16:16Z",
"severity": "MODERATE"
},
"details": "A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.\n\n This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.",
"id": "GHSA-xm4h-9vf3-j26j",
"modified": "2026-03-25T18:31:47Z",
"published": "2026-03-25T18:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20115"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
FKIE_CVE-2026-20115
Vulnerability from fkie_nvd - Published: 2026-03-25 16:16 - Updated: 2026-03-26 15:13
Severity ?
Summary
A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.
This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device information.\r\n\r This vulnerability is due to a device configuration upload being performed over an insecure tunnel. An attacker could exploit this vulnerability by conducting an on-path attack between the affected device and the Cisco Meraki Dashboard. A successful exploit could allow the attacker to view sensitive device configuration information."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el software Cisco IOS XE para Cisco Meraki podr\u00eda permitir a un atacante remoto no autenticado ver informaci\u00f3n confidencial del dispositivo. Esta vulnerabilidad se debe a que una carga de configuraci\u00f3n del dispositivo se realiza a trav\u00e9s de un t\u00fanel inseguro. Un atacante podr\u00eda explotar esta vulnerabilidad al realizar un ataque en la ruta entre el dispositivo afectado y el Cisco Meraki Dashboard. Un exploit exitoso podr\u00eda permitir al atacante ver informaci\u00f3n sensible de la configuraci\u00f3n del dispositivo."
}
],
"id": "CVE-2026-20115",
"lastModified": "2026-03-26T15:13:15.790",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 4.0,
"source": "psirt@cisco.com",
"type": "Primary"
}
]
},
"published": "2026-03-25T16:16:16.533",
"references": [
{
"source": "psirt@cisco.com",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-319"
}
],
"source": "psirt@cisco.com",
"type": "Primary"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…