Connect with us

Hi, what are you looking for?



Cisco Patches High-Severity Vulnerabilities in Enterprise Applications

Cisco has patched high-severity vulnerabilities in enterprise applications that could lead to privilege escalation, SQL injection, and denial-of-service.

Cisco on Wednesday announced security updates for several enterprise applications to patch high-severity vulnerabilities leading to privilege escalation, SQL injection, directory traversal, and denial-of-service (DoS).

The most severe of these impacts the web management interface of Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME).

Tracked as CVE-2023-20211 (CVSS score of 8.1), the bug is described as an improper validation of user-supplied input that could allow a remote, authenticated attacker to perform an SQL injection attack.

“An attacker could exploit this vulnerability by authenticating to the application as a user with read-only or higher privileges and sending crafted HTTP requests to an affected system. A successful exploit could allow the attacker to read or modify data in the underlying database or elevate their privileges,” Cisco explains.

Cisco addressed the flaw with the release of Unified CM and Unified CM SME versions 12.5(1)SU8 and also released a patch file for version 14 of the applications.

The tech giant warns that proof-of-concept (PoC) exploit code targeting the vulnerability has been released.

On Wednesday, Cisco also announced patches for CVE-2023-20224, an elevation of privilege bug in the ThousandEyes Enterprise Agent, Virtual Appliance installation type.

Advertisement. Scroll to continue reading.

Also rooted in the insufficient input validation of user-supplied input, the issue could allow an attacker to authenticate to an affected device via crafted commands. The attacker could then execute commands with root privileges.

The tech giant notes that the attacker must have valid credentials to exploit this vulnerability. The bug was addressed in ThousandEyes Enterprise Agent version 0.230.

While Cisco has not mentioned this, KoreLogic, the company whose researchers discovered the vulnerability, made public technical details this week.

Another insufficient input validation issue, this time in the Duo Device Health Application, could allow attackers to conduct directory traversal attacks and overwrite arbitrary files. Tracked as CVE-2023-20229, the flaw was resolved in version 5.2.0 of the application.

Cisco also announced patches for two DoS vulnerabilities in ClamAV, the free antimalware toolkit that the company included in Secure Endpoint Connectors for Linux, macOS, and Windows, and in Secure Endpoint Private Cloud.

The first of these, CVE-2023-20197, was identified in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV. PoC code targeting the bug has been released publicly, Cisco warns.

Cisco says it is not aware of any of these vulnerabilities being exploited in malicious attacks. However, users are advised to update their installations as soon as possible, as known vulnerabilities in Cisco appliances are often exploited in the wild.

Additional information on the addressed vulnerabilities can be found on Cisco’s product security page.

*updated the patched ThousandEyes Enterprise Agent version and added that KoreLogic has released technical details

Related: Critical Cisco SD-WAN Vulnerability Leads to Information Leaks

Related: Vulnerability in Cisco Enterprise Switches Allows Attackers to Modify Encrypted Traffic

Related: PoC Exploit Published for Cisco AnyConnect Secure Vulnerability

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.