Cisco Ios_xe
541 CVEs affecting Cisco Ios_xe. Latest disclosed: 2025-09-25. Critical: 14, High: 237.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-20188 | Critical | 10.0 | 2025-05-07 | A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE So… |
CVE-2023-20198 | Critical | 10.0 | 2023-10-16 | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list… |
CVE-2021-34770 | Critical | 10.0 | 2021-09-23 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family… |
CVE-2019-12643 | Critical | 10.0 | 2019-08-28 | A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authenticat… |
CVE-2021-1619 | Critical | 9.8 | 2021-09-23 | A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to… |
CVE-2020-3227 | Critical | 9.8 | 2020-06-03 | A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, rem… |
CVE-2018-0315 | Critical | 9.8 | 2018-06-07 | A vulnerability in the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE Software could allow an unauthenticated, remote at… |
CVE-2018-0151 | Critical | 9.8 | 2018-03-28 | A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to ca… |
CVE-2018-0150 | Critical | 9.8 | 2018-03-28 | A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Soft… |
CVE-2017-12236 | Critical | 9.8 | 2017-09-29 | A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 could allow an unauthenticated, remote atta… |
CVE-2017-12229 | Critical | 9.8 | 2017-09-29 | A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to by… |
CVE-2017-3881 | Critical | 9.8 | 2017-03-17 | A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote at… |
CVE-2016-6441 | Critical | 9.8 | 2016-11-03 | A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of… |
CVE-2025-20363 | Critical | 9.0 | 2025-09-25 | A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, C… |
CVE-2025-20186 | High | 8.8 | 2025-05-07 | A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote atta… |
CVE-2023-20231 | High | 8.8 | 2023-09-27 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device… |
CVE-2020-3425 | High | 8.8 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to el… |
CVE-2020-3400 | High | 8.8 | 2020-09-24 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to utilize parts of the web UI for which they are… |
CVE-2020-3141 | High | 8.8 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to el… |
CVE-2019-16009 | High | 8.8 | 2020-09-23 | A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (C… |