Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability

highCVE-2026-20177

A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an unauthenticated, remote attacker to cause the device manager, SSH, or API to become inaccessible. This vulnerability is due to insufficient protection against management plane flooding attacks. An attacker could exploit this vulnerability by sending a high rate of ICMP, SSH, or HTTP traffic to an affected device. A successful exploit could allow the attacker to cause the CPU of the device to increase, resulting in a denial of service (DoS) condition on the device manager web GUI, SSH, or API. Data traffic through the device is not affected. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ie1k-uxq86Lnx Security Impact Rating: Medium CVE: CVE-2026-20177

CSIRTS triage

vendor: Cisco product: Industrial Ethernet 1000 Series Switches Denial of service

What: Insufficient protection against management plane flooding allows unauthenticated remote attackers to cause denial of service of the device manager, SSH, or API.
Who is affected: Cisco IE 1000 Series Switches with exposed management plane are affected.
Urgency: High urgency; remote unauthenticated exploitation can disable management access.
Action: Apply Cisco Industrial Ethernet 1000 Series Switches software updates addressing CVE-2026-20177.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Industrial Ethernet 1000 Series Switches

Get an email when a new Industrial Ethernet 1000 Series Switches advisory drops — max one per day, one-click unsubscribe.

Details

Source: Cisco Security Advisories (INTL · vendor-psirt · site)
Severity: high
Published: 2026-08-19
Exploitation: Not in CISA KEV at last sync

Original advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ie1k-uxq86Lnx?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Industrial%20Ethernet%201000%20Series%20Switches%20Denial%20of%20Service%20Vulnerability%26vs_k=1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-201770.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-20177	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Cisco Industrial Ethernet

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[NEW] [medium] Cisco Industrial Ethernet 1000 Series Switches: Multiple vulnerabilitiescert-bund · 2026-08-20
mediumCVE-2026-20232: A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 S…nvd · 2026-08-19
mediumCVE-2026-20177: A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) …nvd · 2026-08-19
mediumCisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerabilitycisco-psirt · 2026-08-19
criticalexploitedCVE-2017-12235: Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerabi…cisa-kev · 2022-03-03