Cisco informed customers on Wednesday that patches are available for over a dozen critical and high severity vulnerabilities affecting the company’s RV series, SD-WAN, Umbrella and other products.
Two of the flaws have been rated “critical” by Cisco. One of them, CVE-2018-0423, is a buffer overflow vulnerability in the web-based management interface of various RV series firewalls and routers. The security hole allows a remote and unauthenticated attacker to cause a denial-of-service (DoS) condition or to execute arbitrary code.
The second flaw assigned a “critical” rating by the networking giant is CVE-2018-0435 and it impacts the Cisco Umbrella API. A remote attacker could leverage the vulnerability to read or modify data across multiple organizations, but exploitation requires authentication. Cisco noted that the bug has been addressed in the API and no user interaction is required to apply the patch.
The critical vulnerability affecting RV series devices was reported to Cisco by Qingtang Zheng of the 360 ESG CodeSafe Team, who also discovered three additional high severity flaws in the management interface of these products.
Two of the flaws allow an attacker to remotely gain access to sensitive information and one can be exploited for arbitrary command execution, but the latter requires authentication.
The Umbrella solution is also affected by some high severity flaws. Specifically, the Umbrella Enterprise Roaming client has a couple of weaknesses that can be exploited by an authenticated attacker to elevate privileges to “Administrator.” These issues were discovered by a researcher from Critical Start, which has published its own blog post providing detailed technical information.
Cisco’s SD-WAN solution is also impacted by high severity vulnerabilities. They can allow hackers to gain access to sensitive data, execute commands as root, and elevate privileges, but some require either local access and/or authentication.
The company also informed customers that patches are available for serious privilege escalation and information disclosure bugs in WebEx, a DoS flaw in Prime Access Registrar, a privilege escalation in Data Center Network Manager, and two command injections in the Integrated Management Controller (IMC) software.
Cisco is not aware of any instances where these vulnerabilities have been exploited for malicious purposes.
Related: Cisco Patches Critical Flaws in NX-OS Software
Related: Cisco Patches Severe Vulnerabilities in Prime Collaboration Provisioning
Related: Cisco Patches High Risk Flaws in StarOS, IP Phone
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
- Intel Launches New Attestation Service as Part of Trust Authority Portfolio
- Atos Unify Vulnerabilities Could Allow Hackers to Backdoor Systems
Latest News
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- Air Canada Says Employee Information Accessed in Cyberattack
- BIND Updates Patch Two High-Severity DoS Vulnerabilities
- Faster Patching Pace Validates CISA’s KEV Catalog Initiative
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware
