Cisco on Wednesday announced patches for dozens of vulnerabilities in its enterprise products, including a critical-severity flaw in Unified Industrial Wireless software.
The critical bug, tracked as CVE-2024-20418 (CVSS score of 10/10), allows a remote, unauthenticated attacker to inject commands on the underlying operating system, with root privileges.
The issue exists because the web-based management interface of the industrial networking solution does not properly validate input, allowing an attacker to send crafted HTTP requests.
“A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device,” Cisco notes in its advisory.
The security defect affects the company’s Catalyst IW9165D, IW9165E, and IW9167E access points that have the Ultra-Reliable Wireless Backhaul (URWB) operating mode enabled.
Patches for the vulnerability were included in Unified Industrial Wireless software version 17.15.1. Owners of devices running version 17.14 and earlier of the software are advised to migrate to the patched release.
The tech giant also announced fixes for CVE-2024-20536, a high-severity bug in the Nexus Dashboard Fabric Controller (NDFC) that could be exploited for arbitrary SQL command execution.
Insufficient validation of user-supplied input could allow a remote, authenticated attacker to send a crafted request to a specific REST API endpoint or to NDFC’s web-based management interface and read, modify, or delete arbitrary data on an internal database.
Another high-severity flaw resolved on Wednesday, tracked as CVE-2024-20484 and affecting the Enterprise Chat and Email (ECE), could allow a remote, unauthenticated attacker to cause a denial-of-service (DoS) condition.
Insufficient validation of specific traffic could allow an attacker to send crafted traffic to an affected device and trigger a connection failure that would lead to DoS, preventing “customers from starting chat, callback, or delayed callback sessions”. The impacted process would require a manual restart, Cisco explains.
On Wednesday, the tech giant also announced patches for nearly two dozen medium-severity bugs in various enterprise communication and access and networking management solutions.
Cisco says it is not aware of any of the fixed vulnerabilities being exploited in the wild. Additional information can be found on Cisco’s security advisories page.
Related: Researcher Discloses 36 Vulnerabilities Found in IBM Security Verify Access
Related: F5 BIG-IP Updates Patch High-Severity Elevation of Privilege Vulnerability
Related: Unpatched Vulnerability Exposes Horde Webmail Servers to Attacks
Related: Critical Vulnerabilities Patched in Cisco SD-WAN, DNA Center Products
