Cisco fixes severe flaws in data center management solution

guest · Jul 29, 2020

Cisco fixes severe flaws in data center management solution
July 29, 2020
https://www.bleepingcomputer.com/ne...ere-flaws-in-data-center-management-solution/

Cisco today has released several security updates to address three critical authentication bypass, buffer overflow, and authorization bypass vulnerabilities found to affect Cisco Data Center Network Manager (DCNM) and multiple Cisco SD-WAN software products.

The company also issued security updates to fix another eight high and medium severity vulnerability found in to affect several other Cisco DCNM Software versions.
Click to expand...

Auth bypass via DCNM's REST API
The authentication bypass vulnerability tracked as CVE-2020-3382 received a CVSS base score of 9.8/10 and it was found in the REST API of Cisco DCNM.

If successfully exploited by unauthenticated attackers, CVE-2020-3382 could allow them to bypass authentication and remotely execute arbitrary actions on vulnerable devices with administrative privileges, through the REST API.

"The vulnerability exists because different installations share a static encryption key," Cisco explains. "An attacker could exploit this vulnerability by using the static key to craft a valid session token."
Click to expand...

Critical issues impacting SD-WAN software
As mentioned in the beginning, Cisco also fixed two critical vulnerabilities affecting Cisco SD-WAN vManage Software and Cisco SD-WAN Solution Software (including IOS XE SD-WAN Software, SD-WAN vBond Orchestrator Software, SD-WAN vEdge Cloud Routers, SD-WAN vEdge Routers, SD-WAN vManage Software, and SD-WAN vSmart Controller Software).

The first is impacted by an authorization bypass flaw (CVE-2020-3374) with a CVSS score of 9.9 [...]
The second is a buffer overflow bug (CVE-2020-3375) due to insufficient input validation [...]
A list of all security issues addressed by Cisco today is embedded below, together with links to their respective security advisories.
Click to expand...

Log in or Sign up

Cisco fixes severe flaws in data center management solution

guest Guest

Log in or Sign up

Cisco fixes severe flaws in data center management solution

guest Guest

Useful Searches