GCVE-110-NCSC-2025-264

Advisory PublishedCVSS 7.7/10

Vulnetix · Advisory published August 15, 2025

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Weaknesses (CWE)

CWE-404Improper Resource Shutdown or ReleaseCWE-401Missing Release of Memory after Effective LifetimeCWE-415Double FreeCWE-835Loop with Unreachable Exit Condition ('Infinite Loop')CWE-20Improper Input ValidationCWE-643Improper Neutralization of Data within XPath Expressions ('XPath Injection')CWE-284Improper Access ControlCWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-146Improper Neutralization of Expression/Command DelimitersCWE-1244Internal Asset Exposed to Unsafe Debug Access Level or StateCWE-1287Improper Validation of Specified Type of InputCWE-680Integer Overflow to Buffer OverflowCWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CWE-229Improper Handling of ValuesCWE-862Missing AuthorizationCWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')

Risk Scores

CVSS 3.1

7.7/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions	Platforms
Cisco	vers:unknown/7.7.0	—	—
Cisco	vers:unknown/9.23.1	—	—
Cisco	vers:cisco/unknown	—	—

References

advisory

Browse GCVE Records

73,161 records in the GCVE database · Updated July 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON