Cisco Industrial Ethernet 1000 Series Switches vulnerabilities

A vulnerability in the Device Manager web interface of Cisco Industrial Ethernet 1000 Series Switches 1.3 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system. The vulnerability is due to insufficient CSRF protection by the Device Manager web interface.

A vulnerability in the web-based management interface of Cisco Industrial Ethernet 1000 Series Switches allows an authenticated remote attacker to perform a stored XSS attack. The issue is due to insufficient input validation, enabling injection of malicious code into interface pages.

A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet 1000 Series Switches allows an unauthenticated remote attacker to cause the device manager, SSH, or API to become inaccessible. The issue is due to insufficient protection against management plane flooding attacks.