Cisco has released software updates to address four security vulnerabilities in its software that could be weaponized by malicious actors to take control of affected systems.
The most critical of the flaws is CVE-2022-20650 (CVSS score: 8.8), which relates to a command injection flaw in the NX-API feature of Cisco NX-OS Software that stems from a lack of sufficient input validation of user-supplied data.
“An attacker could exploit this vulnerability by sending a crafted HTTP POST request to the NX-API of an affected device,” Cisco said. “A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.”
The flaw impacts Nexus 3000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, and Nexus 9000 Series Switches in standalone NX-OS mode running Cisco NX-OS Software that have the NX-API feature enabled.
Also patched are two high-severity denial-of-service (DoS) bugs in NX-OS – CVE-2022-20624 and CVE-2022-20623 (CVSS scores: 8.6) – found in the Cisco Fabric Services Over IP (CFSoIP) and Bidirectional Forwarding Detection (BFD) traffic functions.
CVE-2022-20624, which was reported to Cisco by the U.S. National Security Agency (NSA), impacts Nexus 3000 and 9000 Series Switches and UCS 6400 Series Fabric Interconnects, assuming CFSoIP is enabled. CVE-2022-20623, on the Read more: https://bit.ly/3LYhQzz