Benoit Malaboeuf

**Name of the Vulnerable Software and Affected Versions** Cisco IOS XE Software (affected versions not specified) **Description** A vulnerability in the Cisco IOx application hosting subsystem could allow an authenticated, local attacker to elevate privileges to root on an affected device. This issue is due to insufficient restrictions on the hosted application. An attacker could exploit this vulnerability by logging in to and then escaping the Cisco IOx application container, potentially allowing the execution of arbitrary commands on the underlying operating system with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco DNA Center Software (affected versions not specified) **Description** A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack, manipulating an authenticated user into executing malicious actions without their awareness or consent. The issue is due to insufficient CSRF protections. An attacker could exploit this by persuading a user to follow a specially crafted link, potentially allowing them to perform arbitrary actions on the device, including modifying the device configuration, disconnecting the user's session, and executing Command Runner commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco DNA Center Software versions prior to 1.3.0.6 Cisco DNA Center Software versions prior to 1.3.1.4 **Description** The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker needs administrator credentials. **Recommendations** For Cisco DNA Center Software versions prior to 1.3.0.6, update to version 1.3.0.6 or later. For Cisco DNA Center Software versions prior to 1.3.1.4, update to version 1.3.1.4 or later. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface with administrator credentials until the issue is resolved.