Cisco informed customers on Monday that the IOS software running on some of the company’s industrial switches is plagued by a denial-of-service (DoS) vulnerability.
The flaw, assigned the identifier CVE-2016-1330 and a CVSS score of 6.1, affects Cisco Industrial Ethernet 2000 Series Switches running IOS Software 15.2(4)E.
The cause of the vulnerability is the way the system processes Cisco Discovery Protocol (CDP) packets. An unauthenticated attacker with access to the network can cause vulnerable devices to reload by sending them specially crafted CDP packets.
Cisco has yet to release a software update to patch the vulnerability and the company says there are no workarounds. The vendor’s product security incident response team (PSIRT) hasn’t found any evidence to suggest that the flaw has been exploited in the wild.
Another issue disclosed by Cisco on Monday is a cross-site scripting (XSS) vulnerability affecting Cisco Emergency Responder, a product designed to help emergency teams manage calls in their phone network and identify the location of 911 callers.
This medium-severity flaw (CVE-2016-1331) allows a remote, unauthenticated attacker to execute arbitrary code in the context of the vulnerable web interface and access potentially sensitive browser information. The security hole can be exploited by tricking the victim into clicking on a malicious link or by injecting malicious code into an intercepted connection.
This vulnerability, which affects Cisco Emergency Responder 11.5(0.99833.5), also remains unpatched with no workarounds available.
Earlier this month, Cisco released updates to patch critical and high impact flaws in several of its products, including Application Policy Infrastructure Controller (APIC), Nexus 9000 switches, Cisco Prime Security Manager (PRSM), and Adaptive Security Appliance (ASA) software.
Related: Cisco Launches Service to Address Shadow IT
Related: Cisco Patches Serious Flaws in Networking, Security Products
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
- Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Hive Ransomware Operation Shut Down by Law Enforcement
- UK Gov Warns of Phishing Attacks Launched by Iranian, Russian Cyberspies
- Dozens of Cybersecurity Companies Announced Layoffs in Past Year
Latest News
- Sentra Raises $30 Million for DSPM Technology
- Cyber Insights 2023: Cyberinsurance
- Cyber Insights 2023: Attack Surface Management
- Cyber Insights 2023: Artificial Intelligence
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- Guardz Emerges From Stealth Mode With $10 Million in Funding
- How the Atomized Network Changed Enterprise Protection
- Critical QNAP Vulnerability Leads to Code Injection
