Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Network Security

Cisco Patches Vulnerabilities in Small Business Routers, Switches

Cisco on Wednesday announced that it has patched several vulnerabilities affecting its products, including flaws in Small Business routers and switches.

Cisco on Wednesday announced that it has patched several vulnerabilities affecting its products, including flaws in Small Business routers and switches.

Of the eight vulnerabilities for which Cisco published an advisory this week, only CVE-2020-3297 has been rated high severity. This security hole affects some Small Business and managed switches and it allows a remote, unauthenticated attacker to access a device’s management interface by hijacking a legitimate user’s session.

“The vulnerability is due to the use of weak entropy generation for session identifier values,” Cisco explained in an advisory. “An attacker could exploit this vulnerability to determine a current session identifier through brute force and reuse that session identifier to take over an ongoing session. In this way, an attacker could take actions within the management interface with privileges up to the level of the administrative user.”

Cisco also informed customers that it has patched a medium-severity cross-site scripting (XSS) vulnerability in its Small Business RV042 and RV042G routers.

CyCognito, whose researchers discovered this flaw, published a blog post describing its findings on Thursday morning. The company told SecurityWeek that the flaw is a reflected XSS and exploitation involves getting the targeted user to click on a specially crafted link.

“An XSS vulnerability in a router’s admin interface means router administrators would be the most likely attack targets,” CyCognito explained. “Attackers would be able to perform actions that an admin could, view information that they could (including their keystrokes, their browser history, clipboard, etc.), modify information, and potentially steal and use admin authentication information to access the vulnerable router at will, or attempt to access other systems using those credentials (i.e., move laterally).”

The remaining vulnerabilities for which Cisco published advisories this week are medium-severity issues affecting the Identity Services Engine, Digital Network Architecture Center, Unified Customer Voice Portal, Unified Communications Manager, and the AnyConnect Secure Mobility Client for macOS.

These security holes can be exploited for DoS and XSS attacks, and to obtain potentially sensitive information. Some of them can be exploited remotely without authentication.

Related: Cisco Patches High Severity Vulnerabilities in Security Products

Related: Cisco Patches Critical Vulnerability in Contact Center Software

Related: Cisco Patches Dozen Vulnerabilities in Industrial Routers

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.