Cisco Prime Network Registrar vulnerabilities

8 CVEs affecting Cisco Prime Network Registrar, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-44487, published 2023-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2019-1840, published 2019-04-18. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to restart the server and cause a denial of service (DoS)…
CVE-2017-6613, published 2017-04-20. Medium severity, CVSS 5.8. EPSS: 2% chance of exploitation in the next 30 days. A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause the DNS process to momentarily restart, which could lead…
CVE-2016-1427, published 2016-06-18. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via…
CVE-2020-3272, published 2020-05-22. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability in the DHCP server of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The…
CVE-2013-3394, published 2013-11-27. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the web interface in Cisco Prime Network Registrar 8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted field, aka…
CVE-2020-3148, published 2020-03-04. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based interface of Cisco Prime Network Registrar (CPNR) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected…
CVE-2015-6296, published 2015-09-18. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. Cisco Prime Network Registrar (CPNR) 8.1(3.3), 8.2(3), and 8.3(2) has a default account, which allows local users to obtain root access by leveraging knowledge of the credentials, aka Bug ID…