Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cisco smart switches. Show all posts
Vulnerabilities and Exploits
Cisco Cisco smart switches High Severity Security patches Vulnerabilities and Exploits

Cisco Releases Patches for Several High Severity Vulnerabilities

 

This week, Cisco addressed a number of high-severity flaws in its Web Security Appliance (WSA), Intersight Virtual Appliance, Small Business 220 switches, and other products. If all of these issues are successfully exploited, attackers may be able to cause a denial of service (DoS), perform arbitrary commands as root, as well as obtain administrator rights. 

Two high-severity vulnerabilities (CVE-2021-34779 and CVE-2021-34780) were discovered within the implementation of the Link Layer Discovery Protocol (LLDP) for Small Business 220 series smart switches, allowing arbitrary code execution and a denial of service condition. The business switch series software update additionally fixes four medium-severity security issues that could cause LLDP storage destruction on a vulnerable device. 

Inadequate input validation inside the Intersight Virtual Appliance is another serious flaw. The security vulnerability, identified as CVE-2021-34748, could allow arbitrary instructions to be executed with root rights. 

Cisco further patched two high-severity flaws in its ATA 190 series and ATA 190 series multiplatform (MPP) software this week. The issues, identified as CVE-2021-34710 and CVE-2021-34735, might be used to execute malicious code and create a denial of service (DoS) scenario, accordingly. 

One of these flaws was disclosed to Cisco by firmware security company IoT Inspector, which published an alert on Thursday 7th of October, detailing its observations. 

Cisco has fixed a race issue in the AnyConnect Secure Mobility Client for Linux and macOS that could've been exploited to execute arbitrary code having admin rights, as well as an inappropriate memory management vulnerability in AsyncOS for Web Security Appliance (WSA) that might result in DoS. 

CVE-2021-1594, an inadequate input validation vulnerability in the REST API of Cisco Identity Services Engine, is yet another high-severity weakness patched this week (ISE). An intruder in a man-in-the-middle position might leverage the issue to execute arbitrary instructions with root access by decrypting HTTPS data between two ISE personas on different nodes. 

Cisco also provided fixes for TelePresence CE and RoomOS, Smart Software Manager On-Prem, 220 series business switches, Identity Services Engine, IP Phone software, Email Security Appliance (ESA), DNA Center, and Orbital, which all have moderate issues. However, Cisco has issued patches for all these flaws and claims that exploits for them have not been publicly revealed.

Read more »
Vulnerabilities and Exploits
Cisco Cisco smart switches User Security Vulnerabilities and Exploits

Cisco Smart Switches Detected with Vulnerabilities

 

In Cisco's Small Business 220 Series smart switches a researcher has uncovered various vulnerabilities, especially those with high severity assessments. This Monday, the networking giant advised its consumers that patches for these vulnerabilities are available. 

The impact switch runs firmware versions earlier than 1.2.0.6 and has the web-based management interface enabled. 

Cisco Systems, Inc. is a US conglomerate based in San Jose, California, in the Silicon Valley center. Cisco designs manufacture and distribute high-tech services and products for networking hardware, software, telecommunications equipment, and others. 

Security researcher Jasper Lievisse Adriaanse has identified the vulnerabilities. He discovered four kinds of safety holes on the small enterprise switch as published in a notice by Cisco. 

One can be used by a remote, unverified attacker, tracked as CVE-2021-1542, which is rated as high severity to take over the user session and obtain access to the web portal of a switch. The attacker could acquire managerial access to the management interface, based on the rights of the potential customer. 

Another high-severity problem is CVE-2021-1541, which enables a remote device attacker with admin access to perform arbitrary root-privileged commands on the operating system underneath it. 

The two other weaknesses identified by the investigator, both of which were Cisco's medium severity, might allow a remote attacker to initiate XSS (CVE-2021-1543) or HTML injection attacks (CVE-2021-1571). 

“[In the case of the] XSS flaw, the vector which I tested and verified was by exploiting a vulnerability in how certain packets which are only valid on the same L2 domain are parsed,” Adriaanse explained. 

He added, “It should be possible, if you’re on the same L2 domain, to perform the XSS attack through CVE-2021-1543, obtain the CSRF token and perform arbitrary actions as the logged-in user. As I don’t write a lot of Javascript I didn’t attempt to write a payload to subsequently exploit CVE-2021-1541. Note however that due to lacking Content-Security-Policy headers you can use CVE-2021-1543 to include remote Javascript code. So you’re not limited by the packet size of the abused L2 protocol. I guess with enough experience and determination one could concoct a payload to do anything in the UI.” 

The XSS defect is due to inspections by the web-based management interface of the device being submitted by the user. An attacker could use this error by deceiving the victims into clicking a malicious link and accessing a certain page. The attacker may induce weakness in running arbitrary script code in connection with the affected interface or access sensitive, browser-based information. 

The HTML Injection Vulnerability is caused by faulty parameter checks on affected pages. In order to address certain vulnerabilities, Cisco has published software updates. 

Read more »
Subscribe to: Posts (Atom)