Cisco fastened critical vulnerabilities throughout a number of of its merchandise this week, together with in its Industrial Community Director, Modeling Labs, ASR 5000 Sequence Routers, and BroadWorks Community Server. The issues can result in administrative command injection, authentication bypass, distant privilege escalation and denial of service.
The Cisco Industrial Community Director (IND), a community monitoring and administration server for operational expertise (OT) networks, obtained patches for 2 vulnerabilities rated essential and medium respectively. These have been fastened in model 1.11.3 of the software program.
The essential flaw, CVE-2023-20036, is within the web-based consumer interface of Cisco IND and will enable authenticated distant attackers to execute arbitrary instructions on the underlying Home windows working system with administrative privileges (NT AUTHORITYSYSTEM). The vulnerability is the results of inadequate enter validation within the performance that permits customers to add System Packs.
The medium-risk flaw fastened in Cisco IND, CVE-2023-20039, is the results of insufficiently sturdy file permissions by default on the applying knowledge listing. A profitable exploit may enable an authenticated attacker to entry delicate data and information from this listing.
Cisco Modeling Labs flaw may enable for unauthorized distant entry
Cisco Modeling Labs, an on-premise community simulation instrument, has a essential vulnerability (CVE-2023-20154) that outcomes from processing sure messages from an exterior LDAP authentication server, which may enable an unauthenticated distant attacker to realize entry to the instrument’s net interface with administrative privileges. This may give them entry to view and modify all simulations and user-created knowledge.
The flaw impacts Modeling Labs for Schooling, Modeling Labs Enterprise and Modeling Labs – Not For Resale, however not Modeling Labs Private and Private Plus. It could actually solely be exploited if the exterior LDAP server is configured in a manner that it responds to go looking queries with a non-empty array of matching entries. The configuration of the LDAP server may be modified by an administrator to mitigate this flaw as a short lived workaround, however clients are suggested to improve Modeling Labs to model 2.5.1 to repair the vulnerability.
Privilege escalation doable with Cisco StarOS flaw
The Cisco StarOS Software program which is used on ASR 5000 Sequence Routers, but additionally on the Virtualized Packet Core – Distributed Occasion (VPC-DI) and Virtualized Packet Core – Single Occasion (VPC-SI) options, has a high-risk vulnerability (CVE-2023-20046) in its implementation of key-based SSH authentication.
Specifically, if an attacker sends an authentication request over SSH from an IP deal with configured because the supply for a high-privileged account, however as an alternative gives the SSH key for a low-privileged account, the system will authenticate them because the high-privileged account regardless that they did not present the proper SSH key. This ends in privilege escalation and is the results of inadequate validation of the provided credentials.
As a workaround, directors may configure all consumer accounts which are accredited for SSH key-based authentication to make use of totally different IP addresses. Nevertheless, Cisco recommends upgrading to a set model of the software program.
Cisco BroadWorks vulnerability may result in denial of service
The Cisco BroadWorks Community Server obtained a patch for a high-risk vulnerability (CVE-2023-20125) in its TCP implementation that might result in a denial-of-service situation. The flaw outcomes from a scarcity of price limiting for incoming TCP connections, permitting unauthenticated distant attackers to ship a excessive price of TCP connections to the server and exhaust its system sources. Clients are suggested to deploy the AP.ns.23.0.1075.ap385072.Linux-x86_64.zip or RI.2023.02 patches.
Cisco additionally patched a number of medium-risk flaws this week in its TelePresence Collaboration Endpoint and RoomOS, Cisco SD-WAN vManage Software program and the Cisco Packet Information Community Gateway. These may end up in arbitrary file write, arbitrary file deletion and IPsec ICMP denial of service.
Copyright © 2023 IDG Communications, Inc.
