Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Network Security

Cisco Patches DoS, Information Disclosure Flaws in Small Business Switches

Cisco this week informed customers that some of its Small Business Switches are affected by high-severity vulnerabilities that can be exploited to obtain sensitive device information and to launch denial-of-service (DoS) attacks.

Cisco this week informed customers that some of its Small Business Switches are affected by high-severity vulnerabilities that can be exploited to obtain sensitive device information and to launch denial-of-service (DoS) attacks.

The flaws, tracked as CVE-2019-15993 and CVE-2020-3147, were reported to the company by Ken Pyle of DFDR Consulting. Both security holes can be exploited remotely and without authentication, and they impact a switch’s web-based user interface.

The information disclosure vulnerability is caused by the lack of proper authentication controls and it can be exploited by sending specially crafted HTTP requests to the user interface of an affected switch. An attacker can leverage this weakness to gain access to configuration files.

The DoS vulnerability, caused due to improper validation of requests sent to the web interface, can be exploited to cause a device to reload and enter a DoS condition by sending it malicious requests.

Cisco has released patches for both vulnerabilities and the company says it’s not aware of any attacks exploiting them.

Last week, Cisco informed customers that Webex Meetings sites had been affected by a serious vulnerability that could be exploited to join password-protected meetings without providing a password. The company said the flaw had been exploited before a patch was released.

“Cisco can confirm customers used the vulnerability to access their own meetings,” Cisco representatives told SecurityWeek. “We are also aware of exploitation of the vulnerability by unauthenticated attendees using the mobile app to gain unauthorized access to Webex’s audio capability.”

Related: Cisco Patches Critical Vulnerability in Network Security Tool

Related: Cisco DCNM Users Warned of Serious Vulnerabilities

Related: Hackers Continue to Exploit Cisco ASA Vulnerability Patched Last Year

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.