Sunday, December 10, 2023

Critical RCE Vulnerability in Cisco Protection let Hackers Execute an Arbitrary code Remotely

Multiple critical security vulnerabilities in Cisco allow attackers to execute arbitrary commands with user consent. The vulnerability affects Cisco FXOS Software, Cisco NX-OS Software, and Cisco UCS Manager Software.

Cisco FXOS and UCS Manager – CLI

A vulnerability in CLI of Cisco FXOS Software and Cisco UCS Manager Software allows an authenticated local attacker to execute arbitrary commands on the user device.

The vulnerability is due to lack of input validation, successful exploitation allows the attacker to execute arbitrary commands on the underlying OS with the privileges of the currently logged-in.

Cisco released security updates to address this vulnerability as a part of the February 2020 Cisco FXOS and NX-OS Software Security Advisory.

Cisco FXOS and UCS Manager Software CLI

The vulnerability resides n the CLI of Cisco FXOS Software and Cisco UCS Manager Software that would allow an authenticated, local attacker to execute arbitrary commands.

An attacker could exploit this vulnerability by sending crafted arguments to specific commands, successful exploit could allow the attacker to execute arbitrary commands on the underlying OS with the privileges of the currently logged-in user.

Cisco released security updates to address this vulnerability as a part of the February 2020 Cisco FXOS and NX-OS Software Security Advisory.

Cisco FXOS and NX-OS Software – Arbitrary Code Execution

The vulnerability allows an unauthenticated, adjacent attacker to execute arbitrary code as root or to cause a denial of service (DoS) condition.

“A successful exploit could allow the attacker to cause a buffer overflow that could allow the attacker to execute arbitrary code as root or cause a DoS condition on the affected device.”

Cisco released security updates to address this vulnerability as a part of the February 2020 Cisco FXOS and NX-OS Software Security Advisory.

Read More:

Cisco Small Business Switches Vulnerabilities allows Attackers to Access Sensitive Information and Cause DoS

Cisco Webex Flaw Let Unauthenticated Remote Attackers to Join Private Meetings Without Password

Website

Latest articles

WordPress POP Chain Flaw Exposes Over 800M+ Websites to Attack

A critical remote code execution vulnerability has been patched as part of the Wordpress...

Russian Star Blizzard New Evasion Techniques to Hijack Email Accounts

Hackers target email accounts because they contain valuable personal and financial information. Successful email...

Exploitation Methods Used by PlugX Malware Revealed by Splunk Research

PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid...

TA422 Hackers Attack Organizations Using Outlook & WinRAR Vulnerabilities

Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative...

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

Endpoint Strategies for 2024 and beyond

Converge and Defend

What's the pulse of Unified Endpoint Management and Security (UEMS) in Europe? Join us live to uncover the strategies that are defining endpoint security in the region.

Related Articles