Pierluigi Paganini July 02, 2020

Cisco announced that it has patched several vulnerabilities affecting its products, including security issues in Small Business routers and switches.

Cisco has addressed eight vulnerabilities affecting its products, including flaws in Small Business routers and switches.

The most severe flaw, tracked as CVE-2020-3297, affects Small Business and managed switches, it has been rated by Cisco as high severity. The vulnerability could allow a remote, unauthenticated attacker to access a device’s management interface by hijacking a legitimate user’s session.

“A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface.” reads Cisco’s advisory “The attacker could obtain the privileges of the highjacked session account, which could include administrator privileges on the device.”

The vulnerability ties the use of weak entropy generation for session identifier values. An attacker could exploit this flaw to determine a current session identifier through brute force and reuse it to hijack the ongoing session.

Cisco also fixed a Cross-Site Scripting issue in Cisco Small Business RV042 and RV042G Routers. The issue tracked as CVE-2020-3431 could be exploited by tricking a user of the interface into clicking a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

“The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.” reads the advisory published by Cisco.

The IT giant also fixed Stored Cross-Site Scripting issues in Cisco Identity Services Engine tracked as CVE-2020-3340.

“Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface.” reads the advisory published by the company.

“These vulnerabilities are due to insufficient validation of user-supplied input that is processed by the web-based management interface. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface.”

The remaining vulnerabilities are all medium-severity issues affecting the Digital Network Architecture Center, Unified Customer Voice Portal, Unified Communications Manager, and the AnyConnect Secure Mobility Client for macOS.

These vulnerabilities can be exploited for DoS and XSS attacks, and lead information disclosure.

Pierluigi Paganini

(SecurityAffairs – hacking, routers)

[adrotate banner=”5″]

[adrotate banner=”13″]