Security News > 2021 > January > Critical Cisco SD-WAN Bugs Allow RCE Attacks
Cisco is warning of multiple, critical vulnerabilities in its software-defined networking for wide-area networks solutions for business users.
Three critical flaws were found in Cisco smart software manager satellite, which offers businesses real-time visibility and reporting of their Cisco licenses.
These flaws, which rank 9.8 out of 10 on the CVSS scale, stem from the Cisco smart software manager satellite's web user interface and could allow an unauthenticated, remote attacker to execute arbitrary commands as a high-privileged user on an affected device.
The flaws affect Cisco Smart Software Manager Satellite releases 5.1.0 and earlier; fixes are available in the Cisco Smart Software Manager On-Prem releases 6.3.0 and later.
Another critical-severity flaw was found in the Command Runner tool of Cisco DNA Center, which is Cisco's network management and command center.
"A successful exploit could allow the attacker to execute arbitrary CLI commands on devices managed by Cisco DNA Center," according to Cisco.
News URL
https://threatpost.com/critical-cisco-sd-wan-bugs-rce-attacks/163204/
Related news
- Critical Veeam RCE bug now used in Frag ransomware attacks (source)
- Palo Alto Networks warns of critical RCE zero-day exploited in attacks (source)
- Critical RCE bug in VMware vCenter Server now exploited in attacks (source)
- Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices (source)
- Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems (source)
- Critical vulnerability in Cisco industrial wireless access points fixed (CVE-2024-20418) (source)
- Cisco scores a perfect CVSS 10 with critical flaw in its wireless system (source)
- HPE warns of critical RCE flaws in Aruba Networking access points (source)
- CISA warns of critical Palo Alto Networks bug exploited in attacks (source)
- New Flaws in Citrix Virtual Apps Enable RCE Attacks via MSMQ Misconfiguration (source)