Menu
Cisco issues fixes for numerous iOS XE, industrial router vulnerabilities

Cisco issues fixes for numerous iOS XE, industrial router vulnerabilities

Issues 23 security advisories that describe 25 exposures in IOS and IOS XE systems

Credit: Dreamstime

Cisco has unleashed an extensive new round of security warnings – three of them “critical” – mostly for users of its iOS XE software and industrial router family.

In total, Cisco issued 23 security advisories that describe 25 exposures in its IOS and IOS XE systems. Beyond the three critical advisories, 20 have a “high” impact rating.

One vulnerability affects Cisco IOS, IOS XE, IOS XR, and NX-OS Software while five vulnerabilities affect both Cisco IOS and IOS XE Software. In addition, six vulnerabilities affect Cisco IOS Software and 10 affect Cisco IOS XE Software, alongside three vulnerabilities affecting the Cisco IOx application environment.

A number of the warnings are for a command-injection vulnerability” that would let an attacker execute commands on the impacted OS.

Cisco has released free software updates that fix the critical warnings issued this week. The vendor also said customers can use the Cisco Software Checker to search for critical or high rated advisories.

The critical warnings include a vulnerability rated at 9.8 out of 10 on the Common Vulnerability Scoring System in the authorisation controls for the Cisco IOx application-hosting infrastructure in Cisco IOS XE software could let an unauthenticated, remote attacker obtain an authorisation token and execute any of the IOx API commands on an affected device.

The vulnerability is due to incorrect handling of requests for authorisation tokens. An attacker could exploit this vulnerability by using a crafted API call to request such a token.

This is in addition to multiple weaknesses rated at 9.8 on the CVSS in Cisco IOS software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could let an unauthenticated, remote attacker or an authenticated local attacker execute arbitrary code on an affected system or cause an affected system to crash and reload.

The vulnerability is due to incorrect bounds checking of certain values in packets that are destined for UDP port 9700 of an affected device. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer-overflow condition may occur, Cisco stated.

Furthermore, a vulnerability rated at 8.8 on the CVSS in the implementation of the inter-VM channel of Cisco IOS software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISR) and Cisco 1000 Series Connected Grid Routers (CGR1000) could let an attacker execute arbitrary commands in the context of the Linux shell of the virtual device server (VDS) with the privileges of the root.

Because the device is designed on a hypervisor architecture, exploitation of a vulnerability that affects the inter-VM channel may lead to a complete system compromise. The vulnerability is due to insufficient validation of signalling packets that are destined to the VDS. An attacker could exploit this vulnerability by sending malicious packets to an affected device, Cisco stated.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags ciscosecurity

Events

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments