Cisco Staros vulnerabilities

25 CVEs affecting Cisco Staros, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-32433, published 2025-04-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability, published 2025-04-16. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2025-06-09. EPSS: 98.8% chance of exploitation in the next 30 days. Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated…
CVE-2018-0239, published 2018-04-19. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASR) 5700 Series devices and Virtualized Packet Core (VPC)…
CVE-2018-0273, published 2018-04-19. Medium severity, CVSS 5.3. EPSS: 3.2% chance of exploitation in the next 30 days. A vulnerability in the IPsec Manager of Cisco StarOS for Cisco Aggregation Services Router (ASR) 5000 Series Routers and Virtualized Packet Core (VPC) System Software could allow an unauthenticated,…
CVE-2019-1869, published 2019-06-20. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability in the internal packet-processing functionality of the Cisco StarOS operating system running on virtual platforms could allow an unauthenticated, remote attacker to cause an affected…
CVE-2013-0149, published 2013-08-05. Medium severity, CVSS 5.8. EPSS: 2.5% chance of exploitation in the next 30 days. The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly…
CVE-2018-0369, published 2018-07-16. High severity, CVSS 8.6. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticated, remote attacker to trigger a reload of the npusim…
CVE-2017-3865, published 2017-07-04. Medium severity, CVSS 5.8. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability in the IPsec component of Cisco StarOS for Cisco ASR 5000 Series Routers could allow an unauthenticated, remote attacker to terminate all active IPsec VPN tunnels and prevent new…
CVE-2015-0711, published 2015-04-29. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and…
CVE-2020-3500, published 2020-08-17. High severity, CVSS 8.6. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability in the IPv6 implementation of Cisco StarOS could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due…
CVE-2021-1378, published 2021-02-17. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability in the SSH service of the Cisco StarOS operating system could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial…

Latest

CVE-2023-20046, published 2023-05-09. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability…
CVE-2022-20665, published 2022-04-06. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient input validation of CLI…
CVE-2021-1540, published 2021-06-04. High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI…
CVE-2021-1539, published 2021-06-04. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software (StarOS) could allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI…
CVE-2021-1353, published 2021-01-20. High severity, CVSS 8.6. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the IPv4 protocol handling of Cisco StarOS could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is…
CVE-2021-1145, published 2021-01-13. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the Secure FTP (SFTP) of Cisco StarOS for Cisco ASR 5000 Series Routers could allow an authenticated, remote attacker to read arbitrary files on an affected device. To exploit this…
CVE-2020-3602, published 2020-10-08. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device. The…
CVE-2020-3601, published 2020-10-08. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device. The…