Cisco has announced patches for a high-severity escalation of privilege vulnerability in AsyncOS for Cisco Secure Web Appliance.
Formerly Web Security Appliance (WSA), Cisco’s Secure Web Appliance is an enterprise protection solution designed to block risky sites and provide application visibility and control.
Tracked as CVE-2022-20871, the newly addressed flaw can be exploited remotely to inject commands and escalate privileges to root, but requires authentication for successful exploitation.
According to Cisco, the security bug exists because user-supplied input for the web interface is not sufficiently validated.
“An attacker could exploit this vulnerability by authenticating to the system and sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root,” Cisco explains.
The tech giant also notes that the attacker needs to have at least read-only credentials to successfully exploit the issue.
Cisco has resolved the vulnerability with the release of AsyncOS for Secure Web Appliance version 14.5.0-537 and plans to release updates for versions 12.5 and 14.0 of the appliance as well.
There are no workarounds available to address the vulnerability and Cisco encourages customers to install the available patches as soon as possible.
Cisco says it is not aware of this vulnerability being exploited in malicious attacks.
Related: Cisco Patches High-Severity Vulnerability in Security Solutions
Related: Cisco Patches Critical Vulnerability in Email Security Appliance
Related: Cisco Warns of Exploitation Attempts Targeting New IOS XR Vulnerability
Related: Cisco Patches 11 High-Severity Vulnerabilities in Security Products
More from Ionut Arghire
- ‘Badsecrets’ Open Source Tool Detects Secrets in Many Web Frameworks
- Chrome 111 Update Patches High-Severity Vulnerabilities
- BreachForums Shut Down Over Law Enforcement Takeover Concerns
- Ransomware Will Likely Target OT Systems in EU Transport Sector: ENISA
- Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager
- Zoom Paid Out $3.9 Million in Bug Bounties in 2022
- Malicious NuGet Packages Used to Target .NET Developers
- Google Pixel Vulnerability Allows Recovery of Cropped Screenshots
Latest News
- Backslash Snags $8M Seed Financing for AppSec Tech
- ‘Badsecrets’ Open Source Tool Detects Secrets in Many Web Frameworks
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- Chrome 111 Update Patches High-Severity Vulnerabilities
- BreachForums Shut Down Over Law Enforcement Takeover Concerns
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Malware Trends: What’s Old Is Still New
- Burnout in Cybersecurity – Can It Be Prevented?
