Vital Patches Issued for Cisco Expressway Sequence, TelePresence VCS Merchandise

Cisco this week shipped patches to deal with a brand new spherical of essential safety vulnerabilities affecting Expressway Sequence and Cisco TelePresence Video Communication Server (VCS) that could possibly be exploited by an attacker to realize elevated privileges and execute arbitrary code.

The 2 flaws – tracked as CVE-2022-20754 and CVE-2022-20755 (CVSS scores: 9.0) – relate to an arbitrary file write and a command injection flaw within the API and web-based administration interfaces of the 2 merchandise that would have severe impacts on affected programs.

The corporate stated each the problems stem from inadequate enter validation of user-supplied command arguments, a weak spot that could possibly be weaponized by an authenticated, distant attacker to hold out listing traversal assaults, overwrite arbitrary recordsdata, and run malicious code on the underlying working system as the basis consumer.

“These vulnerabilities have been discovered throughout inner safety testing by Jason Crowder of the Cisco Superior Safety Initiatives Group (ASIG),” the corporate famous in its advisory revealed Wednesday.

Additionally addressed by Cisco are three different flaws in StarOS, Cisco Id Companies Engine RADIUS Service, and Cisco Extremely Cloud Core – Subscriber Microservices Infrastructure software program –

• CVE-2022-20665 (CVSS rating: 6.0) – A command injection vulnerability in Cisco StarOS that would enable an enable an attacker with administrative credentials to execute arbitrary code with root privileges
• CVE-2022-20756 (CVSS rating: 8.6) – A denial-of-service (DoS) vulnerability affecting the RADIUS characteristic of Cisco Id Companies Engine (ISE)
• CVE-2022-20762 (CVSS rating: 7.8) – A privilege escalation flaw within the Widespread Execution Setting (CEE) ConfD CLI of Cisco Extremely Cloud Core – Subscriber Microservices Infrastructure (SMI) software program that would allow an authenticated, native attacker to escalate to root privileges

Cisco additionally famous that it discovered no proof of malicious exploitation of the vulnerabilities, including they have been both discovered throughout inner safety testing or throughout the decision of a Cisco Technical Help Middle (TAC) assist case.

However nonetheless, clients are urged to replace to the most recent variations as quickly as potential to mitigate any potential in-the-wild assaults.