Cisco security briefs
31 published alerts for Cisco products and services.
Cisco Identity Services Engine Injection Vulnerability
Cisco Identity Services Engine is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2025-20337). Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CISA remediation due date: 2025-08-18. PremierePC tracks KEV alerts for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
Cisco Identity Services Engine Injection Vulnerability
Cisco Identity Services Engine is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2025-20281). Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device. CISA remediation due date: 2025-08-18. PremierePC tracks KEV alerts for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
Cisco ASA and FTD Information Disclosure Vulnerability
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2020-3259). Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. CISA remediation due date: 2024-03-07. If you need help checking exposure, call (864) 335-9223.
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
Cisco Adaptive Security Appliance and Firepower Threat Defense is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2023-20269). Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user. CISA remediation due date: 2023-10-04. If you need help checking exposure, call (864) 335-9223.
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
Cisco AnyConnect Secure is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2020-3433). Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges. CISA remediation due date: 2022-11-14. If you need help checking exposure, call (864) 335-9223.
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Cisco AnyConnect Secure is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2020-3153). Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. CISA remediation due date: 2022-11-14. If you need help checking exposure, call (864) 335-9223.
Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2020-3580). Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface. Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information. CISA remediation due date: 2022-05-03. If you need help checking exposure, call (864) 335-9223.