cisco network assurance engine vulnerabilities

Latest cisco network assurance engine CVEs

Newest publication first

1. CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

   Published 2021-12-10

   Critical·CVSS 10.0 EPSS 100.0% CISA KEV added 2021-12-10 Ransomware Exploited in the wild Framework module Public exploit PoC

   Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messa...

2. CVE-2019-1688 Cisco Network Assurance Engine CLI Access with Default Password Vulnerability

   Published 2019-02-12

   High·CVSS 7.1 EPSS 0.29%

   A vulnerability in the management web interface of Cisco Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service (DoS) condition on the server. The vulnerability is due to a fault in the password manag...

3. CVE-2018-5390 Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

   Published 2018-08-06

   High·CVSS 7.5 EPSS 71.8%

   Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.