National Cyber Awareness System: Cisco Releases Security Updates

Original release date: September 27, 2017
Cisco has released updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates:

• IOS and IOS XE Software DHCP Remote Code Execution Vulnerability cisco-sa-20170927-dhcp
• IOS XE Software Web UI Privilege Escalation Vulnerability cisco-sa-20170927-privesc
• IOS XE Software Web UI REST API Authentication Bypass Vulnerability cisco-sa-20170927-restapi
• IOS XE Software for Cisco ASR 1000 Series and cBR-8 Routers Line Card Console Access Vulnerability cisco-sa-20170927-cc
• IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerabilities cisco-sa-20170927-cip
• IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability cisco-sa-20170927-ike
• IOS XE Wireless Controller Manager Denial-of-Service Vulnerability cisco-sa-20170927-ios-xe
• IOS XE Software Locator/ID Separation Protocol Authentication Bypass Vulnerability cisco-sa-20170927-lisp
• IOS Software Network Address Translation Denial-of-Service Vulnerability cisco-sa-20170927-nat
• IOS XE Software for Cisco 5760 WLC, Cisco Catalyst 4500E Supervisor Engine 8-E, and Cisco NGWC 3850 GUI Privilege Escalation Vulnerability cisco-sa-20170927-ngwc
• IOS and IOS XE Software Plug-and-Play PKI API Certificate Validation Vulnerability cisco-sa-20170927-pnp
• IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability cisco-sa-20170927-profinet
• IOS Software for Cisco Integrated Services Routers Generation 2 Denial-of-Service Vulnerability cisco-sa-20170927-rbip-dos
• IOS Software for Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability cisco-sa-20170927-vpls