Cisco this week announced the release of its April 2022 bundle of security advisories for Cisco Adaptive Security Appliance (ASA), Firepower Threat Defense (FTD), and Firepower Management Center (FMC).
The semiannual bundled advisories describe a total of 19 vulnerabilities in Cisco’s security products, including 11 that were assessed with a severity rating of “high.”
The most severe of these is CVE-2022-20746 (CVSS score of 8.8), an FTD security hole that exists because TCP flows aren’t properly handled, and which could be exploited remotely without authentication to cause a denial of service (DoS) condition.
“An attacker could exploit this vulnerability by sending a crafted stream of TCP traffic through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition,” Cisco explains in an advisory.
The tech giant has addressed the issue with the release of FDT versions 6.6.5.2 and 7.1.0.1. The company also plans the inclusion of fixes in FDT releases 6.4.0.15 and 7.0.2, which are planned for next month.
Several other DoS vulnerabilities were resolved with the same FDT releases, all rated “high severity,” including some that impact ASA as well. They were addressed in ASA releases 9.12.4.38, 9.14.4, 9.15.1.21, 9.16.2.14, and 9.17.1.7.
[ READ: Cisco Patches Virtual Conference Software Vulnerability Reported by NSA ]
Other issues addressed with these software updates could lead to privilege escalation or to the tampering of data transmitted across an IPsec IKEv2 VPN tunnel.
Cisco also resolved an ASA-specific vulnerability that allows an attacker to retrieve process memory containing sensitive information.
This week, the tech giant also announced that Firepower Management Center (FMC) releases 6.6.5.2 and 7.1.0.1 – along with the upcoming releases 6.4.0.15 and 7.0.2 – resolve a remotely exploitable security protection bypass vulnerability.
“An attacker could exploit this vulnerability by uploading a maliciously crafted file to a device running affected software. A successful exploit could allow the attacker to store malicious files on the device, which they could access later to conduct additional attacks, including executing arbitrary code on the affected device with root privileges,” Cisco says.
The company’s semiannual bundled publication of security advisories also details patches for eight medium-severity flaws in these security products.
Cisco is not aware of any attacks exploiting these vulnerabilities.
Related: Cisco Patches Critical Vulnerabilities in Expressway, TelePresence VCS Products
Related: Cisco Patches High-Risk Flaw in ASA, FTD Software
Related: Several High-Severity Vulnerabilities Expose Cisco Firewalls to Remote Attacks
More from Ionut Arghire
- Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager
- Zoom Paid Out $3.9 Million in Bug Bounties in 2022
- Malicious NuGet Packages Used to Target .NET Developers
- Google Pixel Vulnerability Allows Recovery of Cropped Screenshots
- Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- Latitude Financial Services Data Breach Impacts 300,000 Customers
Latest News
- Verosint Launches Account Fraud Detection and Prevention Platform
- Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager
- Zoom Paid Out $3.9 Million in Bug Bounties in 2022
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- News Analysis: UK Commits $3 Billion to Support National Quantum Strategy
- Malicious NuGet Packages Used to Target .NET Developers
- Google Pixel Vulnerability Allows Recovery of Cropped Screenshots
