Cisco Vulnerability Tracker.

This page holds short security alerts about vulnerabilities in Cisco products. It covers 3 items from April 2022 to January 2023. Each entry keeps its original title, publish date and text, newest first and grouped by quarter. Earlier addresses of these entries now lead to the matching entry here.

Jump to: 2023 Q1 | 2022 Q3 | 2022 Q2

2023 Q1

More Than 19,000 Cisco Router Solutions Detected To Be Vulnerable To RCE Attacks

Published: 24 January 2023

It has been detected that more than 19,000 Cisco VPN router devices are exposed to remote code execution (RCE) attacks due to the completion of their lifespan. These devices no longer receive security updates from Cisco, leaving them vulnerable to attacks.

On January 11, 2023, details about a critical security vulnerability affecting the Cisco Small Business router series were released. The vulnerability, identified by the code CVE-2023-20025, occurs due to insufficient authentication on the web-based management tool, allowing unauthorized threat actors to bypass authentication controls and gain administrative privileges to execute arbitrary commands on the vulnerable system.

The vulnerability affects four different Cisco Small Business router models: RV016, RV042, RV042G, and RV082. Cisco has stated in a released advisory that they will not be issuing software updates to address the vulnerability, as the affected models have reached the end of their lifespan, and no temporary solution to address the vulnerability has been found. Studies on the Censys scan engine have observed that approximately 20,000 devices are vulnerable to potential attacks using this vulnerability.

Cisco has published a list of devices that have the potential to be affected by the attacks. Cisco router users are advised to check if their devices are on the list of affected devices and upgrade to a newer, supported version as soon as possible. Additionally, users are recommended to implement network segmentation and utilize firewall solutions to help reduce potential attacks.

2022 Q3

A Critical Security Vulnerability Detected Affecting Cisco ASA And Firepower Solutions

Published: 15 August 2022

A critical security vulnerability has been detected in the Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that could allow an unauthenticated threat actor to gain access to the RSA Private Key. ASA software is the core operating system of Cisco’s ASA security appliances that protect data centers and corporate networks, while FTD software provides next-generation firewall (NGFW) service.

The vulnerability with code CVE-2022-20866 is caused by a logic error caused by storing the RSA key in memory on a hardware platform that performs hardware-based encryption. A remote threat actor can exploit the vulnerability to execute a Lenstra Side-Channel attack and gain access to the RSA key. A compromised RSA Private Key can be used to impersonate a device running Cisco ASA Software or Cisco FTD Software or to decrypt device traffic.

Cisco stated that the vulnerability only affects Cisco ASA Software 9.16.1 and later versions, Cisco FTD Software 7.0.0 and later versions, and has released security updates that fix the vulnerability. In this context, it is recommended that users using vulnerable Cisco ASA and FTD software versions immediately apply the published updates so that they are not the target of attacks that can be carried out using the vulnerability.

2022 Q2

Three Critical Vulnerabilities Detected Affecting Cisco Products

Published: 25 April 2022

Network solutions provider Cisco has released updates to address high-severity security vulnerabilities that could allow threat actors to take control of affected systems and carry out denial-of-service attacks (DoS).

The details of these security vulnerabilities are as follows:

• The vulnerability, tracked by code CVE-2022-20783 and due to lack of authentication, affects Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software.
• The vulnerability tracked by code CVE-2022-20773 and found in Cisco Umbrella Virtual Appliance (VA) relates to a static SSH host switch that allows threat actors to perform potential Man-In-The-Middle (MitM) attacks.
• The vulnerability, tracked by code CVE-2022-20732, could allow threat actors to view and modify database content to elevate their privileges on the affected device.

The company has also fixed many medium-severity vulnerabilities affecting other products in its product line, including Webex Meeting, Unified Communications Products, Umbrella Secure Web Gateway, and IOS XR Software. In this context, it is recommended to immediately upgrade the vulnerable versions to the published updates in order not to be the target of attacks that can be carried out using vulnerabilities..