Cisco Iot Field Network Director

Cisco IoT Field Network Director Unauthenticated REST API Vulnerability

Cisco IoT Field Network REST API Insufficient Input Validation Vulnerability

A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and alter the data of existing users and groups on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the user has administrative privileges, the attacker could create a new, privileged account to obtain full control over the device interface. This vulnerability affects Connected Grid Network Management System, if running a software release prior to IoT-FND Release 3.0; and IoT Field Network Director, if running a software release prior to IoT-FND Release 4.1.1-6 or 4.2.0-123. Cisco Bug IDs: CSCvi02448.

Cisco IoT Field Network Director SOAP API Authorization Bypass Vulnerability

Cisco IoT Field Network Director TLS Renegotiation Denial of Service Vulnerability

A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to cause the system to consume additional memory, eventually forcing the device to restart, aka Memory Exhaustion. The vulnerability is due to insufficient rate-limiting protection. An attacker could exploit this vulnerability by sending a high rate of TCP packets to a specific group of open listening ports on a targeted device. An exploit could allow the attacker to cause the system to consume additional memory. If enough available memory is consumed, the system will restart, creating a temporary denial of service (DoS) condition. The DoS condition will end after the device has finished the restart process. This vulnerability affects the following Cisco products: Connected Grid Network Management System, if running a software release prior to IoT-FND Release 4.0; IoT Field Network Director, if running a software release prior to IoT-FND Release 4.0. Cisco Bug IDs: CSCvc77164.

Cisco IoT Field Network Director Remote Device Denial of Service Vulnerability

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Cisco IoT Field Network Director Resource Exhaustion Denial of Service Vulnerability

Cisco IoT Field Network Director Denial of Service Vulnerability

Cisco IoT Field Network Director Missing API Authentication Vulnerability

Cisco IoT Field Network Director Information Disclosure Vulnerability

Cisco IoT Field Network Director File Overwrite Vulnerability

Cisco IoT Field Network Director Path Traversal Vulnerability

Cisco IoT Field Network Director Command Injection Vulnerability

Cisco IoT Field Network Director Cross-Site Scripting Vulnerabilities

Cisco IoT Field Network Director Improper Access Control Vulnerability

Cisco IoT Field Network Director XML External Entity Vulnerability

Cisco IoT Field Network Director Unprotected Storage of Credentials Vulnerability

Cisco IoT Field Network Director Improper Domain Access Control Vulnerability