Security News > 2020 > January > Ding-dong: Cisco delivers your Patch Tuesday warm-up with WebEx, IOS fixes for a few irritating security holes
Cisco has released a fresh batch of security updates for its networking and comms gear lines.
The high-priority patch this month is the fix for CVE-2019-16009, a cross-site request forgery, in the web UI of Cisco IOS and Cisco IOS XE that can be exploited to steal credentials from users via malicious links.
"A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user," Cisco said of the bug.
CVE-2019-15255 describes a security bypass flaw in the Cisco Identity Services Engine.
Admins would be well-advised to test and install all applicable Cisco patches before next Tuesday, when Microsoft, Adobe, and SAP are all set to drop their scheduled January security updates.
News URL
https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/10/cisco_january_patches/
Related news
- Patch Tuesday: Microsoft Fixes 57 Security Flaws – Including Active Zero-Days (source)
- DeepSeek's iOS app is a security nightmare, and that's before you consider its TikTok links (source)
- February 2025 Patch Tuesday forecast: New directions for AI development (source)
- Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws (source)
- February's Patch Tuesday sees Microsoft offer just 63 fixes (source)
- Microsoft’s Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation (source)
- Patch Tuesday: Microsoft Patches Two Actively Exploited Zero-Day Flaws (source)
- iOS 18 settings to lock down your privacy and security (source)
- Cisco warns of Webex for BroadWorks flaw exposing credentials (source)
- March 2025 Patch Tuesday forecast: A return to normalcy (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-09-23 | CVE-2019-16009 | Cross-Site Request Forgery (CSRF) vulnerability in Cisco IOS A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. | 8.8 |
| 2020-01-26 | CVE-2019-15255 | Unspecified vulnerability in Cisco Identity Services Engine 2.2/2.2(0.470) A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access sensitive information related to the device. | 6.5 |