Networking equipment maker Cisco has released security updates to address three high-severity vulnerabilities in its products that could be exploited to cause a denial-of-service (DoS) condition and take control of affected systems.
The first of the three flaws, CVE-2022-20783 (CVSS score: 7.5), affects Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software, and stems from a lack of proper input validation, allowing an unauthenticated, remote attacker to send specially crafted traffic to the devices.
“A successful exploit could allow the attacker to cause the affected device to either reboot normally or reboot into maintenance mode, which could result in a DoS condition on the device,” the company noted in an advisory.
Credited with discovering and reporting the flaw is the U.S. National Security Agency (NSA). The issue has been addressed in Cisco TelePresence CE Software versions 9.15.10.8 and 10.11.2.2.
CVE-2022-20773 (CVSS score: 7.5), the second flaw to be patched, concerns a static SSH host key that’s present in Cisco Umbrella Virtual Appliance (VA) running a software version earlier than 3.3.2, potentially permitting an attacker to perform a man-in-the-middle (MitM) attack on an SSH connection and hijack the administrator credentials.
A third high-severity vulnerability is a case of privilege escalation in Cisco Virtualized Infrastructure Manager (CVE-2022-20732, CVSS score: 7.8) that grants an authenticated, local attacker to escalate privileges on devices. It’s been resolved in version 4.2.2 of the software.
Read more: https://bit.ly/3MlbJEX
You can also read this: NSA Issues Guidance for Selecting Strong Cisco Password Types