Cisco has patched very serious flaws in some of its networking and communications products, including Enterprise NFV, Expressway, and TelePresence.
Cisco announced that it has patched high-severity vulnerabilities affecting some of its networking and communications products, including Enterprise NFV, Expressway, and TelePresence.
“Multiple vulnerabilities in the API and web management interface of Cisco Expressway Series software and Cisco TelePresence Video Communication Server (VCS) software could allow a remote attacker to bypass certificate validation or conduct malicious attacks. cross-site request forgery on an affected device. .” reads the notice published by the computer giant.
The first vulnerability, tracked as CVE-2022-20814, is an improper certificate validation issue, an unauthenticated remote attacker can trigger it to access sensitive data via a man-in-the-middle attack.
A vulnerability in Cisco Expressway-C and Cisco TelePresence VCS certificate validation could allow an unauthenticated remote attacker to gain unauthorized access to sensitive data.
The vulnerability is due to a lack of SSL server certificate validation for an affected device when establishing a connection to a Cisco Unified Communications Manager device.
“An attacker could exploit this vulnerability by using a man-in-the-middle technique to intercept traffic between devices, then using a self-signed certificate to impersonate the endpoint. A successful exploit could allow the attacker to view intercepted traffic in clear text or modify the content of the traffic, the advice continues.
The flaw does not affect Cisco Expressway-E.
The second issue, tracked by CVE-2022-20853, is Cross-Site Request Forgery (CSRF) which can be exploited to cause a denial of service (DoS) by tricking a user into clicking on a specially crafted link.
“A vulnerability in the Cisco Expressway Series REST API and Cisco TelePresence VCS could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.” indicates the opinion. This vulnerability is due to insufficient CSRF protections for the web management interface of an affected system. An attacker could exploit this vulnerability by tricking a REST API user into following a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.
Cisco PSIRT is not aware of any public announcements or attacks in the wild that exploit these vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook
Pierluigi Paganini
(Security cases – hacking, DoS)
Share on