CISCO-SA-WEBUI-MULTI-ARNHM4V6

CISCO-SA-WEBUI-MULTI-ARNHM4V6 PUBLISHED CVSS 5.400000095367432 MEDIUM

Record from circl · Published May 7, 2025

Multiple vulnerabilities in the web-based management interface of Cisco IOS XE Software could allow a remote attacker to read files from the underlying operating system, read limited parts of the configuration file, clear the syslog, or conduct a cross-site request forgery (CSRF) attack on an affected device, depending on their privilege level. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. This advisory is part of the May 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75279"].

Risk scores

CVSS 3.1

5.400000095367432

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

Vendor	Product	Versions
	16.3.7
	16.4.2
	16.3.5b
	16.2.1
	16.3.3
	16.3.1
	16.3.11
	16.3.8
	16.3.5
	16.3.10
	16.3.1a
	16.1.2
	16.3.9
	16.4.1
	16.2.2
	16.1.1
	16.1.3
	16.3.4
	16.3.2
	16.3.6

Timeline

May 7, 2025 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CISCO-SA-WEBUI-MULTI-ARNHM4V6
vulnetix vdb fixes CISCO-SA-WEBUI-MULTI-ARNHM4V6

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CISCO-SA-WEBUI-MULTI-ARNHM4V6/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →