Cisco released patches in NX-OS software this week for ten high-risk vulnerabilities including some that could lead to code execution and privilege escalation.
Tracked as CVE-2020-3517, the first of the flaws in both FXOS and NX-OS software resides in the Fabric Services component and could lead to a denial of service ( DoS) situation. The problem arises because of the inadequate handling of errors when processing messages from Fabric Providers.
The second issue (CVE-2020-3415) is a remote code execution (RCE) vulnerability in NX-OS software’s Data Management Engine (DME), which could be exploited by sending a designed Discovery Protocol packet to an affected device Layer 2 adjacent to it.
An elevation of the privilege flaw in the Allow Secret feature (CVE-2020-3394) could be misused to obtain full administrative privileges on Nexus 3000 and 9000 series switches. The same devices are affected by a DoS vulnerability (CVE-2020-3397) in the Multicast VPN (MVPN) implementation of the Border Gateway Protocol (BGP). Another DoS problem (CVE-2020-3398) in BGP MVPN also affects the switches in the Nexus 7000 series.
Cisco also discussed CVE-2020-3454, a flaw in the NX-OS call home function that could result in commands running as root, CVE-2020-3338, a DoS problem in the Independent Multicast (PIM) protocol feature for IPv6 networks (PIM6), and CVE-2019-1896, a weakness in the Cisco Integrated Management Controller (IMC) web-based control interface.
The company also released advisory updates addressing two vulnerabilities in command injection (CVE-2018-0307 and CVE-2018-0306) in the NX-OS CLI, which had been patched initially in June 2018. The vulnerabilities could allow a vulnerable CLI command to insert malicious arguments into an attacker.
Updates to NX-OS software were issued to address all of these problems. The company says it is not aware of any of these bugs being “public announcements or malicious use.” Detailed information about all the issues can be found on Cisco ‘s Security Advisories website.
In addition to these NX-OS related bugs, Cisco fixed a medium severity DoS vulnerability (CVE-2020-3504) this week in the Cisco UCS Manager Program local management (local-mgmt) CLI.
The company also released an advisory update addressing a high-risk traversal directory bug in the Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) web services system, which was released last month and documented being exploited shortly afterwards.
