Cisco Releases Security Updates for Multiple Products
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
Cisco DNA Spaces Connector Versions: 2.2 and earlier
Cisco Integrated Management Controller Versions: all
Threat details
Introduction
Cisco has released security updates to address critical or high severity vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.
Remediation advice
Affected organisations are encouraged to review the following Cisco security advisories and apply any relevant updates.
For updates to lower severity vulnerabilities please see the Cisco security advisories page.
Remediation steps
| Type | Step |
|---|---|
| Patch |
Cisco Integrated Management Controller Multiple Remote Code Execution Vulnerabilities | cisco-sa-ucs-api-rce-UXwpeDHd https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-api-rce-UXwpeDHd |
| Patch |
Cisco DNA Spaces Connector Command Injection Vulnerability | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dna-cmd-injection-rrAYzOwc |
| Patch |
Cisco IoT Field Network Director Unauthenticated REST API Vulnerability | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-BCK-GHkPNZ5F |
| Patch |
Cisco Secure Web Appliance Privilege Escalation Vulnerability | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-nPzWZrQj |
| Patch |
Cisco IoT Field Network Director SOAP API Authorisation Bypass Vulnerability | cisco-sa-FND-AUTH-vEypBmmR https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-AUTH-vEypBmmR |
| Patch |
Cisco IoT Field Network Director Missing API Authentication Vulnerability | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-APIA-xZntFS2V |
Last edited: 24 November 2020 12:00 pm