Hendrik Van Belleghem

**Name of the Vulnerable Software and Affected Versions** Cisco IOS Software and Cisco IOS XE Software (affected versions not specified) **Description** A vulnerability in the Authentication, Authorization, and Accounting (AAA) feature could allow an authenticated, remote attacker to bypass command authorization and copy files to or from the file system of an affected device using the Secure Copy Protocol (SCP). This vulnerability is due to incorrect processing of SCP commands in AAA command authorization checks. An attacker with valid credentials and level 15 privileges could exploit this vulnerability by using SCP to connect to an affected device from an external machine. A successful exploit could allow the attacker to obtain or change the configuration of the affected device and put files on or retrieve files from the affected device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the SCP protocol until a patch is available. Restrict access to the affected device to minimize the risk of exploitation. Avoid using the SCP protocol to connect to the affected device until the issue is resolved. Apply the software updates released by Cisco that address this vulnerability. Use the workarounds provided by Cisco that address this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CA Network Flow Analysis versions 9.x through 10.0.x **Description** The issue allows a remote attacker to execute arbitrary commands and compromise system security due to a default credential vulnerability. **Recommendations** For CA Network Flow Analysis versions 9.x through 10.0.x, update the default credentials to secure ones to prevent unauthorized access.