New Flaws Found in Cisco’s Community Working System for Switches

Cisco has launched software program updates to handle 4 safety vulnerabilities in its software program that may very well be weaponized by malicious actors to take management of affected programs.

Probably the most essential of the failings is CVE-2022-20650 (CVSS rating: 8.8), which pertains to a command injection flaw within the NX-API function of Cisco NX-OS Software program that stems from a scarcity of ample enter validation of user-supplied information.

“An attacker may exploit this vulnerability by sending a crafted HTTP POST request to the NX-API of an affected gadget,” Cisco mentioned. “A profitable exploit may permit the attacker to execute arbitrary instructions with root privileges on the underlying working system.”

The flaw impacts Nexus 3000 Sequence Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Sequence Switches, and Nexus 9000 Sequence Switches in standalone NX-OS mode operating Cisco NX-OS Software program which have the NX-API function enabled.

Additionally patched are two high-severity denial-of-service (DoS) bugs in NX-OS – CVE-2022-20624 and CVE-2022-20623 (CVSS scores: 8.6) – discovered within the Cisco Material Providers Over IP (CFSoIP) and Bidirectional Forwarding Detection (BFD) site visitors capabilities.

CVE-2022-20624, which was reported to Cisco by the U.S. Nationwide Safety Company (NSA), impacts Nexus 3000 and 9000 Sequence Switches and UCS 6400 Sequence Material Interconnects, assuming CFSoIP is enabled. CVE-2022-20623, alternatively, solely impacts Nexus 9000 Sequence Switches which have BFD toggled on.

Lastly, the networking tools maker additionally patched a 3rd DoS vulnerability (CVE-2022-20625, CVSS rating: 4.3) within the Cisco Discovery Protocol service of Cisco FXOS Software program and Cisco NX-OS Software program, which may “permit an unauthenticated, adjoining attacker to trigger the service to restart, leading to a denial of service (DoS) situation.”

Cisco mentioned that it isn’t conscious of “any public bulletins or malicious use” of the aforementioned vulnerabilities. That mentioned, it is beneficial that customers transfer shortly to use the required updates to forestall potential real-world exploitation.