Cisco StarOS Flaw Let Attackers Gain Remote Code Execution on Vulnerable Device

Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software had multiple vulnerabilities which could allow an unauthenticated attacker to execute arbitrary commands or disclose sensitive information with “root” privileges. These vulnerabilities were found during Internal Security Testing. It seems that there was no workaround for these vulnerabilities. Cisco’s PSIRT claims that no public announcement has been made on malicious use of this vulnerability.

Products Affected

As Cisco states,” These Vulnerabilities affect Cisco RCM for Cisco StarOS Software”. Cisco has also released the Fixed software section and list of Products that are Vulnerable.

Fixed Releases

Cisco has released software updates to fix the issues. It has advised its customers to upgrade to appropriate fixed software releases.

Cisco RCM for StarOS Release	First Fixed Release
Earlier than 21.25	Migrate to a fixed release.
21.25	21.25.4

Details of the Vulnerabilities

On investigating further, Cisco found that the vulnerabilities are not dependent on one another. In other words, exploitation of one vulnerability will not affect the other.

CVE-2022-20649: Cisco RCM Debug Remote Code Execution Vulnerability

Cisco RCM for Cisco StarOS Software allows an attacker to execute arbitrary commands with root privileges within the configured container. This Vulnerability was due to incorrectly enabled debug mode. When debug mode is enabled, an attacker can connect to the device navigate to the service and exploit it.

Bug ID(s): CSCvy80878

CVE IDs: CVE-2022-20649

Security Impact Rating (SIR): Critical

CVSS Base Score: 9.0

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2022-20648: Cisco RCM Debug Information Disclosure Vulnerability

Cisco RCM for Cisco StarOS Software can use the debug function to perform actions that could result in Sensitive Information Disclosure which must be restricted. This Vulnerability was due to a debug service that incorrectly listens and accepts incoming connections. An attacker with a successful exploit can connect to the debug port to execute debug commands to view sensitive debugging information.

Bug ID(s): CSCvy80857

CVE IDs: CVE-2022-20648

Security Impact Rating (SIR): Medium

CVSS Base Score: 5.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Cisco has released software patches to fix these vulnerabilities. As previously stated, there are no workaround for these vulnerabilities.