Cisco fixes critical flaws in SD
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-1468 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities, see the Details section of this advisory. NVD description · AI analysis pending | 9.8 group max | 2% |
| — | ||
| CVE-2021-1479 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, l Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these vulnerabilities, see the Details section of this advisory. NVD description · AI analysis pending | 9.8 | 2% |
| — | ||
| CVE-2021-1498 +1 in the same advisory: …1497 | Command Injection in Cisco HyperFlex HX Data Platform / Installer VM CVE-2021-1498 is an OS command injection flaw (CWE-78) caused by insufficient input validation in the Cisco HyperFlex HX Installer Virtual Machine, part of the HyperFlex HX Data Platform. An attacker who can reach the vulnerable interface can trigger the flaw and execute arbitrary commands on the affected device with the privileges of the tomcat8 user. Successful exploitation allows the attacker to run commands on the underlying system, potentially facilitating further compromise of the HyperFlex cluster. Organizations running Cisco HyperFlex HX deployments with the affected HX Installer VM are exposed. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog as of 2021-11-03, indicating exploitation in the wild, and EPSS assigns it a 100.0% probability of exploitation within 30 days (100th percentile). Do: Apply the updated HyperFlex HX Data Platform software per Cisco's security advisory, as required by the CISA KEV catalog (due date per KEV policy for federal agencies). Restrict access to the HX Installer VM web interface to trusted management networks while patching. Review affected systems for signs of unexpected command execution by the tomcat8 user, given confirmed in-the-wild exploitation. | 9.8 | 100% | KEV PoC |
| moderate≈1,000–10,000 HX Installer VMs deployed worldwide, with far fewer directly reachable from the internet |
Full article384 words · extracted from securityaffairs.com · click to collapse
Cisco fixed critical flaws in SD-WAN vManage and HyperFlex HX software that could allow creating admin accounts, and executing commands as root.
Cisco has addressed critical vulnerabilities affecting SD-WAN vManage and HyperFlex HX software that could allow creating admin accounts and executing commands as root.
Cisco SD-WAN vManage Software flaws (CVE-2021-1275, CVE-2021-1468, CVE-2021-1505, CVE-2021-1506, CVE-2021-1508) could be exploited by an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information. The flaws could also allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application.
“Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive information, or allow an authenticated, local attacker to gain escalated privileges or gain unauthorized access to the application.” reads the advisory published by Cisco.
Some of the above vulnerabilities only affect software operating in a cluster, in order to verify whether the software is operating in cluster mode, users should check the Cisco SD-WAN vManage web-based management interface Administration > Cluster Management view.
The IT giant also addressed critical Command Injection vulnerabilities, tracked as CVE-2021-1497 and CVE-2021-1498, in the web-based management interface of Cisco HyperFlex HX.
“Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.” reads the company’s advisory.
Cisco’s Product Security Incident Response Team (PSIRT) said that it’s not aware of attacks in the wild exploiting the above vulnerabilities.
In April, Cisco has addressed multiple vulnerabilities in Cisco SD-WAN vManage Software that could be exploited by an unauthenticated, remote attacker to execute arbitrary code or by an authenticated, local attacker to gain escalated privileges on vulnerable systems.
The most severe vulnerability is a critical pre-authentication remote code execution (RCE) issue, tracked as CVE-2021-1479, that affects the remote management component of its SD-WAN vManage Software.
The CVE-2021-1479 flaw could be exploited by an unauthenticated, remote attacker to trigger a buffer overflow on vulnerable devices.
In January, Cisco released security updates to address multiple flaws in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute attacks against vulnerable devices.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, SD-WAN)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/117560/security/cisco-sd-wan-vmanage-hyperflex-hx-flaws.html