Saturday, July 13, 2024
EHA

Critical Cisco Security Flaws Allow Complete Router Firewall Takeover

Cisco patched critical vulnerabilities with Cisco Small Business that allows a remote attacker to take full control of the high-privileged account. Also fixed a privilege escalation vulnerability that impacts Cisco Prime License Manager (PLM) Software.

The patch covers 5 critical vulnerabilities other 22 high and medium severity security vulnerabilities impacting several routers, WebEx, Cisco SD-WAN Solution Software versions and other software.

All the 5 critical vulnerabilities rated 9.8 out of 10 CVSS base score, Following are the critical vulnerabilities.

CVE-2020-3330

The vulnerability is in Cisco Small Business RV110W Wireless-N VPN Firewall Routers, it exists because of a default system account with a static password. By exploiting the device attacker can take complete control over the affected system.

CVE-2020-3323

The vulnerability resides in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers. The vulnerability is due to improper validation of user-supplied input in the web-based management interface.

CVE-2020-3144

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction VPN Router, and RV215W Wireless-N VPN Router.

The vulnerability is due to improper session management, successful exploitation allows an attacker to execute arbitrary code as the root user on the vulnerability.

CVE-2020-3331

The web-based management interface of the Cisco RV110W Wireless-N VPN Firewall and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.

The vulnerability is due to improper validation of user-supplied input in the web-based management interface.

CVE-2020-3140

The vulnerability resides with the web management interface of Cisco Prime License Manager (PLM) Software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device.

The vulnerability is due to improper validation of user-supplied input in the web-based management interface.

Cisco patch covers all the 27 vulnerabilities including the critical, high, and medium severity security vulnerabilities impacting several routers, WebEx, Cisco SD-WAN Solution Software versions, and other software.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Cisco Webex Meetings for Windows Let Hackers Gain Access to Sensitive Data

Critical Flaw in Cisco IOS Routers Let Remote Hackers Take Complete Control of the Systems

Cyber Threat Actors Hacked Cisco Servers by Exploiting SaltStack Vulnerabilities

Website

Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles