Critical Vulnerabilities in Cisco Small Business Series Switches
Cisco has released security advisories including one Critical and eight Medium severity advisories for vulnerabilities in Cisco Small Business Series Switches, Cisco ISE, Cisco SSM On-Prem, Cisco SSM Satellite, and other products
Summary
Cisco has released security advisories including one Critical and eight Medium severity advisories for vulnerabilities in Cisco Small Business Series Switches, Cisco ISE, Cisco SSM On-Prem, Cisco SSM Satellite, and other products
Affected platforms
The following platforms are known to be affected:
Cisco DNA Center
The following platforms are also known to be affected:
- Cisco Business Wireless AP Software
- Cisco SSM On-Prem
- Cisco SSM Satellite
Threat details
Introduction
Cisco has released security advisories including one Critical and eight Medium severity advisories for vulnerabilities in Cisco products. The Critical advisory addresses four unauthenticated stack buffer overflow vulnerabilities with a CVSSv3 score of 9.8, that could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges on an affected device. The Critical advisory also addresses five unauthenticated heap buffer overflow vulnerabilities with CVSSv3 score of 8.6, that could allow an unauthenticated, remote attacker to cause a denial-of-service condition on an affected device.
Proof-of-concept exploit code released
The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept (PoC) exploit code is available for the vulnerabilities that are described in the Critical advisory.
Remediation advice
Affected organisations are encouraged to review the following Cisco Security Advisories for more information.
Remediation steps
| Type | Step |
|---|---|
| Patch |
Cisco Small Business Series Switches Buffer Overflow Vulnerabilities | cisco-sa-sg-web-multi-S9g4Nkgv https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sg-web-multi-S9g4Nkgv |
| Patch |
Cisco Smart Software Manager On-Prem SQL Injection Vulnerability | cisco-sa-ssm-sql-X9MmjSYh https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-sql-X9MmjSYh |
| Patch |
Cisco Identity Services Engine XML External Entity Injection Vulnerabilities | cisco-sa-ise-xxe-inj-696OZTCm https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxe-inj-696OZTCm |
| Patch |
Cisco Identity Services Engine Path Traversal Vulnerabilities | cisco-sa-ise-traversal-ZTUgMYhu https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-ZTUgMYhu |
| Patch |
Cisco Identity Services Engine Command Injection Vulnerabilities | cisco-sa-ise-injection-sRQnsEU9 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9 |
| Patch |
Cisco Identity Services Engine Arbitrary File Download Vulnerabilities | cisco-sa-ise-file-dwnld-Srcdnkd2 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-dwnld-Srcdnkd2 |
| Patch |
Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities | cisco-sa-ise-file-delete-read-PK5ghDDd https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-delete-read-PK5ghDDd |
| Patch |
Cisco DNA Center Software API Vulnerabilities | cisco-sa-dnac-multiple-kTQkGU3 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-multiple-kTQkGU3 |
| Patch |
Cisco Business Wireless Access Points Social Login Guest User Authentication Bypass Vulnerability | cisco-sa-cbw-auth-bypass-ggnAfdZ https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cbw-auth-bypass-ggnAfdZ |
CVE Vulnerabilities
Last edited: 18 May 2023 2:41 pm