Cisco plugs bucketful of security holes in industrial routers, switches
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-3258 | Multiple vulnerabilities in Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Gr Multiple vulnerabilities in Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an unauthenticated, remote attacker or an authenticated, local attacker to execute arbitrary code on an affected system or cause an affected system to crash and reload. For more information about these vulnerabilities, see the Details section of this advisory. NVD description · AI analysis pending | 9.8 group max | 5% |
| — | ||
| CVE-2020-3227 | A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remo A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute Cisco IOx API commands without proper authorization. The vulnerability is due to incorrect handling of requests for authorization tokens. An attacker could exploit this vulnerability by using a crafted API call to request such a token. An exploit could allow the attacker to obtain an authorization token and execute any of the IOx API commands on an affected device. NVD description · AI analysis pending | 9.8 | 3% |
| — |
Full article237 words · extracted from helpnetsecurity.com · click to collapse
Cisco has fixed more than two dozen critical and high-severity security vulnerabilities affecting operating systems running on the company’s carrier-grade and industrial routers and switches.
About the vulnerabilities
OSes affected by various combinations of the now-fixed flaws include:
- Cisco IOS – a family of network operating systems used on many Cisco Systems routers and network switches
- IOS XE – installed on a variety of Cisco controllers, switches, edge, branch and virtual routers
- IOS XR – used on Cisco’s high-end Network Converging System (NCS), carrier-grade routers
- NX-OS – installed on Cisco’s Nexus-series hardware-based network switches, fabric extenders, storage switches and fabric interconnects
The four fixed critical vulnerabilities are:
- CVE-2020-3227, a privilege escalation vulnerability – affects Cisco IOS XE Software releases 16.3.1 and later if they are configured with the IOx application hosting infrastructure.
- CVE-2020-3205, a command injection vulnerability and CVE-2020-3198 and CVE-2020-3258, multiple arbitrary code execution flaws – affecting Cisco 809 and 829 Industrial Industrial Integrated Services Routers and Cisco 1000 Series Connected Grid Routers (CGR1000)
The high-severity issues include a wide variety of security flaw, which could allow: command injection, DoS, verification bypass, RCE, arbitrary file creation/read/overwrite, information disclosure, and so on.
Users of Cisco networking equipment should check whether they should upgrade the software and, if that’s the case, do so as soon as they can – though most of the vulnerabilities were discovered during internal testing and none are under active exploitation.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/06/04/cisco-plugs-security-holes/