Cisco IOS XE Software Plug-and-Play Privilege Escalation Vulnerability

A vulnerability in a diagnostic command for the Plug-and-Play (PnP) subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to the level of an Administrator user (level 15) on an affected device. The vulnerability is due to insufficient protection of sensitive information. An attacker with low privileges could exploit this vulnerability by issuing the diagnostic CLI show pnp profile when a specific PnP listener is enabled on the device. A successful exploit could allow the attacker to obtain a privileged authentication token. This token can be used to send crafted PnP messages and execute privileged commands on the targeted system.

N/A

通过日志文件的信息暴露

Cisco IOS XE Software 日志信息泄露漏洞

Cisco IOS XE Software是美国思科（Cisco）公司的一个操作系统。用于企业有线和无线访问，汇聚，核心和WAN的单一操作系统，Cisco IOS XE降低了业务和网络的复杂性。 Cisco IOS XE Software 存在日志信息泄露漏洞，该漏洞源于对敏感信息保护不足。攻击者可利用该漏洞将受影响设备上的权限提升到管理员用户的级别(15级)。

N/A

日志信息泄露