EUVD-2026-53475
GHSA-7wh7-mfpx-74m2
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Network-exploitable via HTTPS management interface (AV:N), requires crafting a specific malformed certificate (AC:H) and valid low-privilege credentials (PR:L); device reload propagates beyond the web process to system scope (S:C) with no confidentiality or integrity impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to insufficient error handling in the web-based management interface. An attacker could exploit this vulnerability by authenticating with a malformed certificate. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
AnalysisAI
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with low privileges to reload an affected device by presenting a malformed certificate during authentication. The root cause is insufficient error handling (CWE-126, buffer over-read) in the certificate parsing path of the HTTPS management interface, affecting a broad swath of IOS XE releases from 17.3.x through 26.x. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The web-based management interface (HTTPS server) must be explicitly enabled on the target device via 'ip http secure-server' - it is not universally enabled by default and is commonly disabled in hardened IOS XE deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.3 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H presents a moderate-severity DoS with several important qualifiers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained valid low-privilege credentials for a Cisco IOS XE device's web-based management interface - whether through credential stuffing, phishing, or compromise of a junior network operator account - crafts a malformed X.509 certificate and presents it during the HTTPS authentication handshake to the management interface. The certificate passes initial processing but triggers a buffer over-read in the certificate parsing code, causing an unhandled exception that propagates to the OS layer and forces a full device reload, taking the device offline for several minutes and disrupting all transit traffic and management connectivity during the reboot cycle. |
| Remediation | Upgrade to a fixed Cisco IOS XE Software release as directed by the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-webui-dos-PtAODAWW - exact patched version numbers must be verified directly through that advisory, as specific fix releases are not independently confirmed from the data provided here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Ios Xe Software
View allImproper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthentic
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to g
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by a
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a com
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected
Denial-of-service in Cisco IOS XE Software's web-based management interface (WebUI) allows an authenticated remote attac
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today