Description:

Cisco has released security updates to address several vulnerabilities in the following products:

• Cisco IOS XE Software
• Cisco IOS
• 4000 Series Integrated Services Routers
• ASR 920 Series Aggregation Services Routers
• ASR 1000 Series Aggregation Services Routers
• cBR-8 Converged Broadband Routers
• Cisco Industrial Ethernet (support PROFINET):
  • 2520 Connected Grid Switches
  • Catalyst IE3200 Rugged Series Switches
  • Catalyst IE3300 Rugged Series Switches
  • Catalyst IE3400 Rugged Series Switches
  • Catalyst IE3400 Heavy Duty Series Switches
  • Embedded Services 2020 Series Switches
  • Embedded Services 3300 Series Switches
  • Industrial Ethernet 1000 Series Switches
  • Industrial Ethernet 2000 Series Switches
  • Industrial Ethernet 2000U Series Switches
  • Industrial Ethernet 3000 Series Switches
  • Industrial Ethernet 3010 Series Switches
  • Industrial Ethernet 4000 Series Switches
  • Industrial Ethernet 4010 Series Switches
  • Industrial Ethernet 5000 Series Switches
• Cisco Catalyst 9800 Series Wireless Controllers
• 1000 Series Integrated Services Routers
• 1100 Series Industrial Integrated Services Routers
• 1100 Terminal Services Gateways
• 4221 Integrated Services Routers
• 4300 Series Integrated Services Routers
• Catalyst 9800-L and 9800-CL Wireless Controllers (no other models are affected)
• Cloud Services Router 1000V Series
• ESR6300 Embedded Series Routers
• Integrated Services Virtual Routers
• VG400 Analog Voice Gateways
• Catalyst 9800 Series Wireless Controllers
• Wireless LAN Controllers (WLC)
• Cisco Catalyst 9200 Series Switches
• Cisco ASR 900 Series Aggregation Services Routers
• Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family
• Cisco cBR-8 Converged Broadband Routers
• Cisco ASR 1000 Series Aggregation Services Routers
• Catalyst 9800 Embedded Wireless Controller for Catalyst 9300, 9400, and 9500 Series Switches
• Catalyst 9800 Series Wireless Controllers
• Embedded Wireless Controller on Catalyst 9100 Access Points
• Aironet 1540 Series APs
• Aironet 1560 Series APs
• Aironet 1800 Series APs
• Aironet 2800 Series APs
• Aironet 3800 Series APs
• Aironet 4800 APs
• Business 100 Series APs and Mesh Extenders
• Business 200 Series APs
• Catalyst 9100 APs
• Catalyst IW 6300 APs
• ESW6300 Series Aps
• Integrated Access Point on 1100 Integrated Services Routers
• Cisco Catalyst 9200 Series Switches
• Cisco 4461 Integrated Services Routers
• Cisco Catalyst 9300 Series Switches
• Cisco Catalyst 9500 Series Switches

Threats:

Attacker could exploit these vulnerabilities by doing the following:

• Code execution
• Denial of service attack (DoS)
• Bypass of a protection mechanism
• Escalation of privilege
• Information disclosure

Best practice and Recommendations:

The CERT team encourages users to review Cisco security advisory and apply the necessary updates:

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-zbfw-94ckG4G
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xbace-OnCEbyS
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wpa-dos-cXshjerc
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-auth-bypass-6j2BYUc7
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-splitdns-SPWqpdGW
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rommon-secboot-7JgVLVYC
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-profinet-J9QMCHPB
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mdns-dos-3tH6cA9J
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-le-drTOB625
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsla-jw2DJmSv
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-wlc-fnfv9-EvrAQpNX
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-umbrella-dos-t2QMUX37
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-rsp3-rce-jVHg8Z7c
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-isdn-q931-dos-67eUZBTf
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ewlc-snmp-dos-wNkedg9K
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-dhcp-dos-JSCKX43h
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-webui-priv-esc-K8zvEWM
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-profinet-dos-65qYG3W5
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-lpwa-access-cXsD7PRA
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esp20-arp-dos-GvHVggqJ
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dclass-dos-VKh9D8k3
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-confacl-HbPtfSuO
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capwap-dos-TPdNTdyq
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capwap-dos-ShFzXf
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ethport-dos-xtjTt8pY
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-dos-VHr2zG9y
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-JP-DOS-g5FfGm8y
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISR4461-gKKUROhx
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-COPS-VLD-MpbTvGEW
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unauth-file-access-eBTWkKVW
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-usb-guestshell-WmevScDj
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-iox-app-host-mcZcnsBt
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ctbypass-7QHAfHkK
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-cmdinj-2MzhjM6K
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-webui-multi-vfTkk7yr
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-lua-rce-7VeJX4f
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-bgp-evpn-dos-LNfYJxfF
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-disclosure-V4BmJBNF
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-file-overwrite-Ynu5PrJD
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-icmpv6-qb9eYyCR
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironet-dos-h3DCuLXw
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-WEB-UI-exNFmcPO