As Cisco uses bash (and web interfaces if you haven't disable it) is it susceptible to the shell shock vulnerability?
Yes, It's possible that they are vulnerable. Although they are not sure yet. Cisco believes, that devices are only vurnerable, once you're authenticated. Therefore you can only exploit the bug when you'd have admin privilege anyway.
Check the following link for more information and status updates: http://tools.cisco.com/security/center/mcontent/CiscoSecurityAdvisory/cisco-sa-20140926-bash