Cisco informed customers on Wednesday that it has released software updates for several of its products to address critical and high severity vulnerabilities.
The most serious of the issues is a critical vulnerability related to the existence of insecure default credentials in the NX-OS network operating system running on Cisco Nexus 3000 series and Nexus 3500 platform switches. The flaw, identified as CVE-2016-1329, can be exploited by a remote, unauthenticated attacker to log into a vulnerable device with root privileges via an account that has a default and static password.
The problem is that the account in question, which is created during installation, cannot be changed or removed without affecting the system’s functionality.
The security hole affects Cisco Nexus 3000 Series Switches running NX-OS 6.0(2)U6(1), 6.0(2)U6(2), 6.0(2)U6(3), 6.0(2)U6(4), and 6.0(2)U6(5), and Cisco Nexus 3500 Platform Switches running versions 6.0(2)A6(1), 6.0(2)A6(2), 6.0(2)A6(3), 6.0(2)A6(4), 6.0(2)A6(5), and 6.0(2)A7(1). Users who cannot immediately install the updates that fix the issue can apply workarounds described in Cisco’s advisory.
The networking giant has also released a software update to patch a high severity denial-of-service (DoS) vulnerability in the SNMP input packet processor of Nexus 5500 and 5600 Platform switches, and Nexus 6000 series switches running NX-OS.
An unauthenticated attacker can exploit the flaw, tracked as CVE-2015-6260, to remotely cause the SNMP application to restart by sending a specially crafted SNMP packet to the targeted device. A malicious actor can cause the application to restart multiple times, which could lead to a system-level restart and a DoS condition.
The vulnerability affects NX-OS release 7.1(1)N1(1) and it has been patched with the release of version 7.1(2)N1(1). No workarounds are available.
A different high severity DoS flaw has been found in NX-OS’s TCP stack (CVE-2015-0718). A remote, unauthenticated attacker can send a specially crafted TCP packet to a targeted device and cause it to enter a DoS condition.
The issue affects Cisco Nexus 1000V, 3000, 4000, 5000, 6000 and 7000 series switches, and Unified Computing System (UCS) running NX-OS.
A different advisory published by Cisco on Wednesday describes a high severity DoS vulnerability (CVE-2016-1288) in the web proxy framework of the Cisco Web Security Appliance (WSA). A remote attacker can cause a temporary DoS condition on vulnerable devices by sending them malformed HTTPS request packets.
Cisco says it’s not aware of any instances where these vulnerabilities have been exploited for malicious purposes.
