Cisco this week informed customers that some of its Small Business Switches are affected by high-severity vulnerabilities that can be exploited to obtain sensitive device information and to launch denial-of-service (DoS) attacks.
The flaws, tracked as CVE-2019-15993 and CVE-2020-3147, were reported to the company by Ken Pyle of DFDR Consulting. Both security holes can be exploited remotely and without authentication, and they impact a switch’s web-based user interface.
The information disclosure vulnerability is caused by the lack of proper authentication controls and it can be exploited by sending specially crafted HTTP requests to the user interface of an affected switch. An attacker can leverage this weakness to gain access to configuration files.
The DoS vulnerability, caused due to improper validation of requests sent to the web interface, can be exploited to cause a device to reload and enter a DoS condition by sending it malicious requests.
Cisco has released patches for both vulnerabilities and the company says it’s not aware of any attacks exploiting them.
Last week, Cisco informed customers that Webex Meetings sites had been affected by a serious vulnerability that could be exploited to join password-protected meetings without providing a password. The company said the flaw had been exploited before a patch was released.
“Cisco can confirm customers used the vulnerability to access their own meetings,” Cisco representatives told SecurityWeek. “We are also aware of exploitation of the vulnerability by unauthenticated attendees using the mobile app to gain unauthorized access to Webex’s audio capability.”
Related: Cisco Patches Critical Vulnerability in Network Security Tool
Related: Cisco DCNM Users Warned of Serious Vulnerabilities
Related: Hackers Continue to Exploit Cisco ASA Vulnerability Patched Last Year
