Skip to content
OpenAdvisories
High ICSA-22-300-03 9 CVEs

Rockwell Automation Stratix Devices Containing Cisco IOS

Published Oct 27, 2022 · Updated Oct 27, 2022

Vendor: Rockwell Automation Product: Stratix Devices

Summary

Successful exploitation of these vulnerabilities could lead to a denial-of-service condition and allow remote code execution.

Vulnerabilities 9

  • High 8.8
    CVE-2020-3219

    Cisco IOS XE Software Web UI Command Injection Vulnerability

    A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. The vulnerability is due to …

    Cisco Cisco IOS XE Software 16.1.1 iOS Network devices
  • High 8.8
    CVE-2020-3229

    Cisco IOS XE Software Web UI Privilege Escalation Vulnerability

    A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The vulnerability is due to incorre…

    Cisco Cisco IOS XE Software 16.2.2 iOS Network devices
  • High 8.6
    CVE-2021-1446

    Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability

    A vulnerability in the DNS application layer gateway (ALG) functionality used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a lo…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 7.7
    CVE-2020-3200

    Cisco IOS and IOS XE Software Secure Shell Denial of Service Vulnerability

    A vulnerability in the Secure Shell (SSH) server code of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. The vulnerability is due to an internal state not being represented corr…

    Cisco Cisco IOS 12.2(58)SE iOS Network devices
  • High 7.2
    CVE-2020-3211

    Cisco IOS XE Software Web UI Command Injection Vulnerability

    A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input saniti…

    Cisco Cisco IOS XE Software 16.10.1 iOS Network devices
  • High 7.2
    CVE-2020-3218

    Cisco IOS XE Software Web UI Remote Code Execution Vulnerability

    A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation o…

    Cisco Cisco IOS XE Software 16.6.1 iOS Network devices
  • Medium 6.8
    CVE-2020-3209

    Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

    A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an imprope…

    Cisco Cisco IOS XE Software 3.2.0SG iOS Network devices
  • Medium 6.5
    CVE-2021-1385

    Cisco IOx Application Environment Path Traversal Vulnerability

    A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticated, remote attacker to conduct directory traversal attacks and read and write files on the underlying operating system or host system. This …

    Cisco Cisco IOS iOS Network devices
  • Medium 4.3
    CVE-2020-3516

    Cisco IOS XE Software Web UI Improper Input Validation Vulnerability

    A vulnerability in the web server authentication of Cisco IOS XE Software could allow an authenticated, remote attacker to crash the web server on the device. The vulnerability is due to insufficient input validation during authentication. An attacker could e…

    Cisco Cisco IOS XE Software iOS Network devices

Revision history

  1. #1

    Initial Publication

References