Cisco Expressway flaw allows unauthenticated remote root commands
Original title: Cisco Expressway Series Remote Code Execution Vulnerability
An attacker who has the persistent cookies can reach the database service and run RPC commands as root.
A vulnerability in the database service of Cisco Expressway Series could let an unauthenticated remote attacker with network access run arbitrary operating-system commands as root. The issue involves persistent cookies and insufficient validation of client certificates when TLS Verify Mode is set to Enabled for clustering. An attacker who possesses the cookies can connect to the database service and invoke specific RPC commands. The advisory snippet ends before describing the full outcome, fixes, or workarounds.
Unconfirmed: The snippet is cut off and does not state fixed versions, workarounds, or exploitation status.
- Commands would run as root on the Expressway device.
- Client certificates are not validated in the described clustering TLS setting.
- Exploitation requires possession of the persistent cookies and network access.
- The attacker connects to the database service and invokes RPC commands.
Impact: Execute arbitrary operating-system commands as root
| Product | Affected |
|---|---|
| Cisco Expressway Series | — |
- Vendors
- Cisco
- Products
- Cisco Expressway Series
From the original article
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.