Cisco Releases Security Updates for Multiple Products
Cisco has released security updates to address two Critical, two High and two Medium severity vulnerabilities in Cisco Industrial Network Director (IND), Cisco Modeling Labs, and other products
Summary
Cisco has released security updates to address two Critical, two High and two Medium severity vulnerabilities in Cisco Industrial Network Director (IND), Cisco Modeling Labs, and other products
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
- Cisco StarOS
- Cisco SD-WAN vManage Software
- Cisco TelePresence Collaboration Endpoint (CE)
- Cisco RoomOS
Threat details
Introduction
Cisco has released security updates to address two Critical, two High and two Medium severity vulnerabilities in Cisco Industrial Network Director (IND), Cisco Modeling Labs, and other products. The first Critical advisory, covering both CVE-2023-20036 and CVE-2023-20039, could allow an authenticated attacker to inject arbitrary operating system commands or access sensitive data. The second Critical advisory covers a single vulnerability, CVE-2023-20154, that could allow an unauthenticated, remote attacker to access the web interface with administrative privileges.
Remediation advice
Affected organisations are encouraged to review the following Cisco Security Advisories for more information.
Remediation steps
| Type | Step |
|---|---|
| Patch |
Cisco Industrial Network Director Vulnerabilities | cisco-sa-ind-CAeLFk6V https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-CAeLFk6V |
| Patch |
Cisco Modeling Labs External Authentication Bypass Vulnerability | cisco-sa-cml-auth-bypass-4fUCCeG5 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cml-auth-bypass-4fUCCeG5 |
| Patch |
Cisco StarOS Software Key-Based SSH Authentication Privilege Escalation Vulnerability | cisco-sa-staros-ssh-privesc-BmWeJC3h https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-ssh-privesc-BmWeJC3h |
| Patch |
Cisco BroadWorks Network Server TCP Denial of Service Vulnerability | cisco-sa-bw-tcp-dos-KEdJCxLs https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-tcp-dos-KEdJCxLs |
| Patch |
Cisco SD-WAN vManage Software Arbitrary File Deletion Vulnerability | cisco-sa-sdwan-vmanage-wfnqmYhN https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-wfnqmYhN |
| Patch |
Cisco TelePresence Collaboration Endpoint and RoomOS Arbitrary File Write Vulnerabilities | cisco-sa-roomos-file-write-rHKwegKf https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-file-write-rHKwegKf |
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 20 April 2023 12:53 pm