Cisco vulnerability scanning increase

[morriswurm () yahoo com]

We recently picked up a spike in TCP 80 scanning against one of our netblocks. 

Looking at the payload, it appears to be a Cisco vulnerability scanner.

 /level/16/exec/-///pwd

Numerous random source IP's across various netblocks, makes it appear to be bot related potentially. Anyone else seeing 
this type of activity?