Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,754exploited flaws on CISA’s list

33added in the last 30 days

298new WordPress flaws this week

13,868entries in the database

374 results · page 6 of 8

Mar 25, 2022Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCVE-2020-2021 · Network & remote access · Palo Alto NetworksExploitedRansomware
Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
Product
PAN-OS
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022D-Link Multiple Routers Command Injection VulnerabilityCVE-2019-16920 · Network & remote access · D-LinkExploited
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
Product
Multiple Routers
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Juniper Junos OS Path Traversal VulnerabilityCVE-2020-1631 · Network & remote access · JuniperExploited
A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.
Product
Junos OS
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Juniper’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service VulnerabilityCVE-2009-2055 · Network & remote access · CiscoExploited
Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
Product
IOS XR
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Citrix SD-WAN and NetScaler Command Injection VulnerabilityCVE-2019-12991 · Network & remote access · CitrixExploited
Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
Product
SD-WAN and NetScaler
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022D-Link DCS-930L Devices OS Command Injection VulnerabilityCVE-2016-11021 · Network & remote access · D-LinkExploited
setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.
Product
DCS-930L Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022NETGEAR WNR2000v5 Router Buffer Overflow VulnerabilityCVE-2016-10174 · Network & remote access · NETGEARExploited
The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.
Product
WNR2000v5 Router
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Sophos SG UTM Remote Code Execution VulnerabilityCVE-2020-25223 · Network & remote access · SophosExploited
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
Product
SG UTM
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022NETGEAR DGN2200 Devices OS Command Injection VulnerabilityCVE-2017-6334 · Network & remote access · NETGEARExploited
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
Product
DGN2200 Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Cisco VPN Routers Remote Code Execution VulnerabilityCVE-2018-0125 · Network & remote access · CiscoExploited
A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.
Product
VPN Routers
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Cisco Secure Access Control System Java Deserialization VulnerabilityCVE-2018-0147 · Network & remote access · CiscoExploited
A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.
Product
Secure Access Control System (ACS)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Citrix SD-WAN and NetScaler SQL Injection VulnerabilityCVE-2019-12989 · Network & remote access · CitrixExploited
Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
Product
SD-WAN and NetScaler
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service VulnerabilityCVE-2010-3035 · Network & remote access · CiscoExploited
Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
Product
IOS XR
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022D-Link DSL-2760U Gateway Cross-Site Scripting VulnerabilityCVE-2013-5223 · Network & remote access · D-LinkExploited
A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.
Product
DSL-2760U
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Cisco Prime Data Center Network Manager (DCNM) Directory Traversal VulnerabilityCVE-2015-0666 · Network & remote access · CiscoExploited
Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.
Product
Prime Data Center Network Manager (DCNM)
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022D-Link and TRENDnet Multiple Devices Remote Code Execution VulnerabilityCVE-2015-1187 · Network & remote access · D-Link and TRENDnetExploited
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.
Product
Multiple Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link and TRENDnet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022TP-Link Multiple Archer Devices Directory Traversal VulnerabilityCVE-2015-3035 · Network & remote access · TP-LinkExploited
Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
Product
Multiple Archer Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022NETGEAR Multiple WAP Devices Command Injection VulnerabilityCVE-2016-1555 · Network & remote access · NETGEARExploited
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
Product
Wireless Access Point (WAP) Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 25, 2022Cisco IOS and IOS XE Remote Code Execution VulnerabilityCVE-2017-3881 · Network & remote access · CiscoExploited
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.
Product
IOS and IOS XE
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 15, 2022SonicWall SonicOS Buffer Overflow VulnerabilityCVE-2020-5135 · Network & remote access · SonicWallExploitedRansomware
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.
Product
SonicOS
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 7, 2022Pulse Connect Secure Code Injection VulnerabilityCVE-2020-8218 · Network & remote access · Pulse SecureExploited
A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
Product
Pulse Connect Secure
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install Pulse Secure’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 7, 2022NETGEAR Multiple Routers Remote Code Execution VulnerabilityCVE-2016-6277 · Network & remote access · NETGEARExploited
NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.
Product
Multiple Routers
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 7, 2022NETGEAR DGN2200 Remote Code Execution VulnerabilityCVE-2017-6077 · Network & remote access · NETGEARExploited
NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.
Product
Wireless Router DGN2200
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service VulnerabilityCVE-2017-12235 · Network & remote access · CiscoExploited
A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
Product
IOS software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20708 · Network & remote access · CiscoExploited
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20703 · Network & remote access · CiscoExploited
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20701 · Network & remote access · CiscoExploited
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20700 · Network & remote access · CiscoExploited
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20699 · Network & remote access · CiscoExploited
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco Small Business Routers Improper Input Validation VulnerabilityCVE-2019-1652 · Network & remote access · CiscoExploited
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.
Product
Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS Software Denial-of-Service VulnerabilityCVE-2018-0180 · Network & remote access · CiscoExploited
A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.
Product
IOS Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS Software Denial-of-Service VulnerabilityCVE-2018-0179 · Network & remote access · CiscoExploited
A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.
Product
IOS Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS, XR, and XE Software Buffer Overflow VulnerabilityCVE-2018-0175 · Network & remote access · CiscoExploited
Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.
Product
IOS, XR, and XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Improper Input Validation VulnerabilityCVE-2018-0174 · Network & remote access · CiscoExploited
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Product
IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS and IOS XE Software Improper Input Validation VulnerabilityCVE-2018-0173 · Network & remote access · CiscoExploited
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS and IOS XE Software Improper Input Validation VulnerabilityCVE-2018-0172 · Network & remote access · CiscoExploited
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS, XR, and XE Software Buffer Overflow VulnerabilityCVE-2018-0167 · Network & remote access · CiscoExploited
There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code.
Product
IOS, XR, and XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS Software Resource Management Errors VulnerabilityCVE-2018-0161 · Network & remote access · CiscoExploited
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition.
Product
IOS Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service VulnerabilityCVE-2018-0159 · Network & remote access · CiscoExploited
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.
Product
IOS Software and Cisco IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service VulnerabilityCVE-2018-0156 · Network & remote access · CiscoExploited
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.
Product
IOS Software and Cisco IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service VulnerabilityCVE-2018-0155 · Network & remote access · CiscoExploited
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition.
Product
Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS Software Integrated Services Module for VPN Denial-of-Service VulnerabilityCVE-2018-0154 · Network & remote access · CiscoExploited
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.
Product
IOS Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution VulnerabilityCVE-2018-0151 · Network & remote access · CiscoExploited
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS Software SNMP Remote Code Execution VulnerabilityCVE-2017-6744 · Network & remote access · CiscoExploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6.
Product
IOS software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6743 · Network & remote access · CiscoExploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6740 · Network & remote access · CiscoExploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6739 · Network & remote access · CiscoExploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6738 · Network & remote access · CiscoExploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6737 · Network & remote access · CiscoExploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6736 · Network & remote access · CiscoExploited
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.