High

DATE	CVE	VULNERABILITY TITLE	RISK
2024-09-11	CVE-2024-20381	Unspecified vulnerability in Cisco IOS XR A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device.  This vulnerability is due to improper authorization checks on the API. network low complexity cisco	8.8
2021-08-04	CVE-2021-1572	Improper Privilege Management vulnerability in Cisco Confd and Network Services Orchestrator A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, which is commonly root. local low complexity cisco CWE-269	7.8
2018-10-05	CVE-2018-0463	Unspecified vulnerability in Cisco Network Services Orchestrator 1.2.0 A vulnerability in the Cisco Network Plug and Play server component of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to gain unauthorized access to configuration data that is stored on an affected NSO system. network low complexity cisco	7.5
2018-06-07	CVE-2018-0274	OS Command Injection vulnerability in Cisco Network Services Orchestrator A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. network low complexity cisco CWE-78	8.8