This week, Cisco Systems released another set of patches. It patched routers, WSA and conferencing software, closing two dozen vulnerabilities.
The danger level of 12 bugs is rated as high, the rest – as moderate.The most serious problems are identified in the software of the RV series of routers for small business, the Web Security Appliance (WSA) security systems, as well as in the TelePresence product line. All of them received 8.8 points on the CVSS scale.
“The vulnerability CVE-2019-15271 in the RV016, RV042, RV042G, and RV082 routers allows, after authorization, to remotely execute any command with root privileges on the device. You can use this bug by submitting a maliciously crafted HTTP request to the web interface”, – indicated in the Cisco bulletin.
Users are advised to update the firmware to build 4.2.3.10.
Exploitation of vulnerability CVE-2019-15956 in Cisco WSA also requires authorization and is sent by sending a special HTTP request. If successful, the attacker could remotely cause a network reset, leading to a denial of service, or change the administrator password and gain privileged access to the device. In both scenarios, you will have to manually recover the system after the attack. Vulnerabilities are affected by WSA-complexes running AsyncOS branches 10.1, 10.5, 11.5 and 11.7. The problem will be solved by updating the software to the release 10.1.5-004, 11.5.3-016 or 11.7.1-006.
Read also: Researcher Discovered Two Critical Vulnerabilities in rConfig Utility
The vulnerability CVE-2019-15288 is present in the CLI utility included in the TelePresence Collaboration Endpoint (CE), TelePresence Codec (TC), and RoomOS packages. According to the developers, an authorized attacker can take advantage of the flaw by passing specific arguments when connecting to the device via SSH. (In TelePresence CE, TC, and RoomOS, SSH access is enabled by default.).
“Successful operation will allow the attacker to gain unlimited user level access to the limited shell of the vulnerable system”, – the bulletin said.
The patch is included with Cisco TelePresence CE Software 9.8.1 and Cisco TC Software 7.3.19, which can be downloaded from the company’s Download Center. RoomOS is also patched; No action is required from users of the Cisco Cloud Conference Service.
The remote code execution bug in Prime Infrastructure and Evolved Programmable Network Manager software (CVE-2019-15958) was rated at 8.1 points by CVSS, since it can only be used when registering a new device on the network and initial setup.