Security News > 2021 > August > Cisco fixes critical, high severity pre-auth flaws in VPN routers

Cisco has addressed pre-auth security vulnerabilities impacting multiple Small Business VPN routers and allowing remote attackers to trigger a denial of service condition or execute commands and arbitrary code on vulnerable devices.

Luckily, as the company explains, the remote management feature is disabled by default on all affected VPN router models.

"The web-based management interface for these devices is available through local LAN connections by default and cannot be disabled there," Cisco says.

In August 2020, Cisco warned of actively exploited zero-day bugs in carrier-grade IOS XR routers with multicast routing enabled.

One month later, in October 2020, Cisco again warned of attacks actively targeting a separate high severity vulnerability impacting the IOS XR Network OS deployed on the same router models.

In July 2020, Cisco fixed another actively exploited ASA/FTD firewall bug and a pre-auth critical remote code execution flaw that could lead to full device takeover on vulnerable devices.

News URL

https://www.bleepingcomputer.com/news/security/cisco-fixes-critical-high-severity-pre-auth-flaws-in-vpn-routers/