EUVD-2026-53475
GHSA-7wh7-mfpx-74m2
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Network-exploitable via HTTPS management interface (AV:N), requires crafting a specific malformed certificate (AC:H) and valid low-privilege credentials (PR:L); device reload propagates beyond the web process to system scope (S:C) with no confidentiality or integrity impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to insufficient error handling in the web-based management interface. An attacker could exploit this vulnerability by authenticating with a malformed certificate. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
AnalysisAI
Denial of service in Cisco IOS XE Software's web-based management interface allows an authenticated remote attacker with low privileges to reload an affected device by presenting a malformed certificate during authentication. The root cause is insufficient error handling (CWE-126, buffer over-read) in the certificate parsing path of the HTTPS management interface, affecting a broad swath of IOS XE releases from 17.3.x through 26.x. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of IOS XE in enterprise and service provider networks makes even a low-probability DoS meaningful at scale.
Technical ContextAI
CWE-126 (Buffer Over-read) indicates the web management interface reads beyond the bounds of an allocated buffer while parsing a malformed X.509 certificate presented during TLS authentication. The affected component is the IOS XE HTTPS server (ip http secure-server), which handles certificate-based or certificate-influenced authentication flows. Cisco IOS XE is a Linux-based network operating system deployed across a wide range of Cisco platforms - ISR, ASR, Catalyst, CSR, and others - identified by CPE cpe:2.3:a:cisco:cisco_ios_xe_software. The 'Apple' tag in the intelligence data may reference certificate parsing library heritage or TLS stack components, though this is not confirmed by the advisory text. The CVSS scope change (S:C) reflects that the over-read triggers a system-wide reload rather than crashing only the web process - the fault propagates to the device kernel/OS layer, disrupting all management planes and transit traffic.
RemediationAI
Upgrade to a fixed Cisco IOS XE Software release as directed by the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-webui-dos-PtAODAWW - exact patched version numbers must be verified directly through that advisory, as specific fix releases are not independently confirmed from the data provided here. As an immediate compensating control where patching is not feasible, disable the web-based management interface entirely using the IOS XE commands 'no ip http server' and 'no ip http secure-server'; this eliminates the attack surface completely but requires migrating all management workflows to CLI via SSH or console access. Where the web interface must remain enabled, restrict access using an HTTP access class ACL ('ip http access-class') scoped to trusted administrative IP ranges, which substantially reduces exposure by preventing low-privilege external accounts from reaching the vulnerable endpoint - though this does not protect against an insider or compromised trusted-network account. Note that ACL restriction reduces but does not eliminate risk, as the vulnerability requires only PR:L credentials, which may exist within the permitted IP range.
More in Cisco Ios Xe Software
View allImproper neutralization of special elements (CWE-74 injection class) in Cisco IOS XE Software allows remote, unauthentic
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to g
Denial-of-service via malformed XMCP packets forces unexpected reloads of Cisco IOS and IOS XE devices, exploitable by a
Denial-of-service in Cisco IOS XE Software's Blocks Extensible Exchange Protocol (BEEP) feature allows an unauthenticate
Unauthenticated remote denial-of-service affecting Cisco IOS XE Software across a wide version range results from multip
Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS proce
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discovera
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through i
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a com
Improper BOOTP packet handling in Cisco IOS XE Software on Catalyst 9000 Series Switches allows unauthenticated remote a
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Denial of service in Cisco IOS XE Software's SNMP subsystem allows an authenticated remote attacker to force an affected
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today