Cisco’s IOS software hosted more than two dozen security vulnerabilities that could have allowed attackers to gain remote access and execute commands without proper authentication. Four of those security bugs were cited as “critical.”

The flaws were announced as part of Cisco’s latest IOS and IOS XE Security Advisory Bundled Publication. The vendor has already released fixes for the bugs.

Three of the most critical flaws impacted the Cisco IOS platform running on several different company routers. These include the Cisco 809 and 829 Industrial Integrated Service Routers (ISRs) and 1000-series Connected Grid Routers (CGR).

The first two of those – CVE-2020-3189 and CVE-2020-3258 – were lumped together as providing an unauthenticated remote hacker or an authenticated local hacker to execute arbitrary code on a system or cause that system to crash and reload. While that sounds innocuous, they did garner a 9.8 score out of 10 on the Common Vulnerability Scoring System (CVSS).

The third flaw impacting the software on those same routers – CVE-2020-3205 – involves the implementation of the inter-virtual machine channel that if exploited could allow an unauthenticated, adjacent attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of a device. This flaw drew an 8.8 CVSS score.

The fourth critical bug – CVE-2020-3227 – is in the authorization controls for the Cisco IOx application hosting infrastructure in its IOS XE software. This impacts the 16.3.1 release of the IOS XE software, or later versions if they use the IOx application hosting infrastructure. If exploited it could allow an unauthenticated, remote attacker to execute Cisco IOx API commands without proper authorization. This flaw also garnered a 9.8 CVSS score.

The remaining vulnerabilities were judged as having a “high” security impact on variants of Cisco’s IOS software platform.

Cisco last month was busy quashing the latest security bugs that impacted routers running its SD-WAN software, and a dozen bugs in its Adaptive Security Appliance (ASA) and Firepower 1000 Series firewall appliances and Cisco Firepower Threat Defense (FTD) software used to protect corporate networks and data centers.