Now on Demand: Threat Detection and Incident Response (TDIR) Summit - All Sessions Available
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Network Security

Cisco Warns of Vulnerability in Discontinued Small Business Routers

Cisco says it will not release patches for a cross-site scripting vulnerability impacting end-of-life small business routers.

Cisco has issued a warning from a cross-site scripting (XSS) vulnerability in end-of-life (EoL) RV series small business routers.

Tracked as CVE-2024-20362 and remotely exploitable without authentication, the flaw impacts the small business RV016, RV042, RV042G, RV082, RV320, and RV325 routers, which have been discontinued and no longer receive security patches.

While Cisco says it is not aware of this vulnerability being exploited in the wild, there are no workarounds for the bug and users are advised to migrate to a supported product. Discontinued Cisco networking devices are known to have been exploited in attacks.

The company described the issue as insufficient validation in the web interface of the affected products allows attackers to mount XSS attacks by convincing users to visit a malicious page, which could lead to script execution or information leaks.

The cybersecurity vendor also announced patches for several other vulnerabilities across its product portfolio, including a high-severity defect in Nexus Dashboard Fabric Controller (NDFC) that could allow unauthenticated, remote attackers to read arbitrary files.

The bug, CVE-2024-20348, exists due to an unauthenticated provisioning web server that can receive direct requests from a remote attacker, allowing them to read sensitive files in the Plug and Play (PnP) container, opening the door to further attacks on the PnP infrastructure.

The flaw impacts NDFC version 12.1.3b with a default configuration. NDFC versions 12.1.2 and earlier and 12.2.1 are not affected.

Cisco also announced patches for several medium-severity bugs in TelePresence Management Suite, Nexus Dashboard, Nexus Dashboard Orchestrator, Identity Services Engine (ISE), Enterprise Chat and Email, Unified Communications Manager IM & Presence Service, and Emergency Responder.

Advertisement. Scroll to continue reading.

The company says it is not aware of any of these bugs being exploited in attacks. Additional information can be found on Cisco’s security advisories page.

Related: Cisco Patches DoS Vulnerabilities in Networking Products

Related: Cisco Patches High-Severity IOS RX Vulnerabilities

Related: Cisco Patches High-Severity Vulnerabilities in VPN Product

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

Wendy Zheng named as CFO and Joe Diamond as CMO at cyber asset management firm Axonius.

Intelligent document processing company ABBYY has hired Clayton C. Peddy as CISO.

Digital executive protection services provider BlackCloak has appointed Ryan Black as CISO.

More People On The Move

Expert Insights