Cisco published security upgrades this week to fix numerous flaws in its device line, including crucial glitches in some VPN routers and SD-WAN devices for small businesses.
The company warned that seven significant vulnerabilities that could be exploited by unauthenticated, remote attackers to execute arbitrary code as root could impact the web-based management interface of small business RV160, RV160W, RV260, RV260P, and RV260W VPN routers. You may select a Managed IT Provider that can manage small vulnerabilities in the network security in a small business.
The problem, Cisco says, persists because HTTP requests are poorly validated. The bugs were resolved with the introduction of firmware versions 1.0.01.02 and later for all of the affected devices with classified critical intensity (CVSS score of 9.8). Two flaws of high severity were also fixed in these units.
Six vulnerabilities in SD-WAN products have been patched by the software firm, the most significant of which is graded as critical severity (CVSS score 9.9). Though not relying on each other, the problems fixed may be misused to execute root privilege behaviour on the affected computers.
The faults affect SD-WAN vBond Orchestrator Software, SD-WAN vEdge Cloud Routers, SD-WAN vEdge Routers, SD-WAN vEdge Routers, SD-WAN vManage Software, and SD-WAN vSmart Controller Software, generated by inappropriate input validation of user-supplied input.
These addressed vulnerabilities were fixed by Cisco in SD-WAN Updates 19.2.4, 20.1.2, 20.3.2, and 20.4.1. The organisation further states that it is not aware of the exploitation in the wild of these vulnerabilities.
The company also outlined various high severity vulnerabilities in small business RV series routers this week, including a collection of 30 bugs that contribute to arbitrary code execution or denial of service, and another of 5 problems that could be abused by a remote attacker to insert arbitrary commands and execute them with root rights.
The bugs influenced the RV016, RV042, RV042G, RV082, RV320, and RV325 series routers due to insufficient validation of user-supplied inputs, and were resolved with the introduction of firmware update 1.5.1.13 for the RV320 and RV325 routers.
However, since they have already achieved end-of-life status, the Cisco RV016, RV042, RV042G, and RV082 routers will not offer updates.
Other high-risk vulnerabilities that Cisco fixed this week impact IOS XR software: one IPv6 protocol denial of service and two IOS XR software input packet processing capabilities, and two image verification bugs and one privilege escalation that affect Cisco 8000 series routers and Network Convergence System (NCS) 540 series routers with IOS XR software.
In SD-WAN products, several high-gravity problems were also discussed, including five bugs that could lead to denial of service, and three authorization bypasses that could allow attackers to change settings, access confidential information, or display data without authorization.
Cisco also released Webex, Unified Computing System (UCS), IOS XR Applications, Managed Services Accelerator (MSX), and DNA Center fixes for medium severity flaws, and announced that it will issue software upgrades to correct several glitches in dnsmasq’s DNS forwarder implementation.
On Wednesday, with the inclusion of Virtual Topology System (formerly Cisco Virtual Systems Operations Center) – VTSR VM and Ultra Cloud, the technology firm extended the scope of items impacted by the latest Sudo vulnerability.
Further information on the flaws Cisco has discussed this week in its products can be found on the security portal of the company.
