Cisco on Wednesday introduced patches for six vulnerabilities in its merchandise, together with three high-severity bugs in NX-OS and FXOS software program that might be exploited to trigger a denial-of-service (DoS) situation.
Impacting the FXOS software program of Firepower 4100 and Firepower 9300 security home equipment and of UCS 6300 sequence material interconnects, probably the most extreme of those flaws is CVE-2023-20200, described because the improper dealing with of particular SNMP requests.
The difficulty permits an authenticated, distant attacker to ship crafted SNMP requests to an affected machine and trigger it to reload, leading to a DoS situation.
“This vulnerability impacts all supported SNMP variations. To use this vulnerability by SNMPv2c or earlier, an attacker should know the SNMP group string that’s configured on an affected machine. To use this vulnerability by SNMPv3, the attacker will need to have legitimate credentials for an SNMP consumer who’s configured on the affected machine,” Cisco explains.
The second high-severity flaw, CVE-2023-20169, impacts the NX-OS software program for Nexus 3000 and Nexus 9000 sequence switches in standalone NX-OS mode, and is described as an inadequate enter validation within the Intermediate System-to-Intermediate System (IS-IS) protocol.
The bug permits an unauthenticated, Layer 2 adjoining attacker to ship crafted IS-IS packets to an affected machine, inflicting the IS-IS course of to restart, which might trigger the machine to reload, resulting in a DoS situation.
Cisco additionally patched a high-severity vulnerability within the TACACS+ and RADIUS distant authentication for NX-OS software program. Tracked as CVE-2023-20168, the bug is described as an incorrect enter validation difficulty that enables an unauthenticated, native attacker to enter a crafted string at login and trigger a DoS situation.
The flaw impacts a number of Nexus sequence switches, the MDS 9000 sequence switches, and the Nexus 1000 digital edge for VMware vSphere, and may solely be exploited over Telnet or over the console administration connection.
The three vulnerabilities had been resolved as a part of Cisco’s August 2023 semiannual security advisory bundle, which additionally consists of patches for 2 medium-severity bugs resulting in file overwrites.
On Wednesday, Cisco additionally introduced patches for a medium-severity difficulty within the Software Coverage Infrastructure Controller (APIC), which “might enable an authenticated, distant attacker to learn, modify, or delete non-tenant insurance policies created by customers related to a unique security area on an affected system”.
The tech large says it isn’t conscious of any of those vulnerabilities being exploited in malicious assaults. Further info may be discovered on Cisco’s product security web page.
