Cisco IOS known exploited vulnerabilities
We track 12 CVEs in Cisco IOS. All of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2022–2026). The most recent is CVE-2008-4128, added to KEV on .
Also listed as: IOS 12.4 mainline · IOS Software. CISA, NVD and vendor advisories name the same product differently; each CVE page keeps the wording from its source.
- CVEs tracked
- 12
- On CISA KEV
- 12
- Ransomware use
- 0
- Rated critical
- 0
Every Cisco IOS CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2008-4128 Cisco IOS 12.4 HTTP admin CSRF on the 871 Integrated Services Routerwrite-up | [ MEDIUM ] | 4.3 | 33.9% | ||
| CVE-2004-1464 Cisco IOS Denial-of-Service Vulnerability | [ MEDIUM ] | 5.9 | 4.8% | ||
| CVE-2018-0180 Cisco IOS Software Denial-of-Service Vulnerability | [ MEDIUM ] | 5.9 | 4.9% | ||
| CVE-2018-0179 Cisco IOS Software Denial-of-Service Vulnerability | [ MEDIUM ] | 5.9 | 4.9% | ||
| CVE-2018-0161 Cisco IOS Software Resource Management Errors Vulnerability | [ MEDIUM ] | 6.3 | 4.1% | ||
| CVE-2018-0154 Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability | [ HIGH ] | 7.5 | 7.1% | ||
| CVE-2017-6744 Cisco IOS Software SNMP Remote Code Execution Vulnerability | [ HIGH ] | 8.8 | 7.3% | ||
| CVE-2017-12235 Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability | [ HIGH ] | 7.5 | 7.1% | ||
| CVE-2017-12234 Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | [ HIGH ] | 7.5 | 7.1% | ||
| CVE-2017-12233 Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | [ HIGH ] | 7.5 | 7.1% | ||
| CVE-2017-12232 Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability | [ MEDIUM ] | 6.5 | 2.2% | ||
| CVE-2017-12231 Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability | [ HIGH ] | 7.5 | 7.1% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/cisco.json.
Our Cisco IOS coverage
Other Cisco products
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.