Known vulnerabilities in Cisco Expressway

Vendor: Cisco Systems, Inc
Software: Cisco Expressway
Software CPE: cpe:2.3:a:cisco_systems:cisco_expressway:*:*:*:*:*:*:*:*
Website: https://www.cisco.com
Total vulnerabilities: 14
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Cisco Expressway Cisco Expressway is affected by 14 known vulnerabilities: 1 high, 6 medium, 7 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU63424 - Information Exposure Through Log Files
CVE-2022-20809		 CWE-532 Low
No
No
 14.0.7 19.05.2022 SB2022051906
#VU63421 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2022-20807		 CWE-611 Low
No
No
 14.0.7 19.05.2022 SB2022051906
#VU63420 - External Control of File Name or Path
CVE-2022-20806		 CWE-73 Low
No
No
 14.0.7 19.05.2022 SB2022051906
#VU60967 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-20755		 CWE-78 Medium
No
No
 X14.0.5 02.03.2022 SB2022030223
#VU60966 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-20754		 CWE-22 Medium
No
No
 X14.0.5 02.03.2022 SB2022030223
#VU56678 - Server-Side Request Forgery (SSRF)
CVE-2021-40438		 CWE-918 High
Available
Exploited
 X14.0.4, X14.1, X14.2 17.09.2021 SB2021091706
SB2021091707
SB2021092301
and 42 more
#VU56029 - Improper Cleanup on Thrown Exception
CVE-2021-34716		 CWE-460 Low
No
No
 X14.0.3 23.08.2021 SB2021082303
#VU56028 - Improper Verification of Cryptographic Signature
CVE-2021-34715		 CWE-347 Low
No
No
 X14.0.3 23.08.2021 SB2021082303
#VU48563 - Improper Access Control
CVE-2020-3482		 CWE-284 Medium
No
No
 X12.6.3 18.11.2020 SB2020111909
#VU47528 - Uncontrolled Memory Allocation
CVE-2020-3596		 CWE-789 Medium
No
No
 - 08.10.2020 SB2020101308
#VU17433 - Cross-Site Request Forgery (CSRF)
CVE-2019-1679		 CWE-352 Low
No
No
 - 07.02.2019 SB2019020714
#VU8897 - Improper input validation
CVE-2017-12287		 CWE-20 Low
No
No
 - 19.10.2017 SB2017101913
#VU12994 - Memory corruption
CVE-2017-3790		 CWE-119 Medium
No
No
 - 25.01.2017 SB2017012506
#VU12996 - Improper input validation
CVE-2016-9207		 CWE-20 Medium
No
No
 - 07.12.2016 SB2016120702