Security News > 2021 > September > Cisco Issues Patch for Critical Enterprise NFVIS Flaw — PoC Exploit Available

Cisco has patched a critical security vulnerability impacting its Enterprise Network Function Virtualization Infrastructure Software that could be exploited by an attacker to take control of an affected system.

The network equipment maker said it's aware of a publicly available proof-of-concept exploit code targeting the vulnerability, but added it's not detected any successful weaponization attempts in the wild.

The issue is caused due to incomplete validation of user-supplied input that's passed to an authentication script during the sign-in process, enabling an attacker to inject parameters into an authentication request.

"A successful exploit could allow the attacker to bypass authentication and log in as an administrator to the affected device," the company said in an advisory.

It's worth pointing out that enterprise NFVIS deployments are impacted by this vulnerability only if TACACS external authentication method is configured on a targeted device, which can be determined by running the "Show running-config tacacs-server" command.

The patches come a little over a week after Cisco rolled out updates to address a critical security vulnerability affecting the Application Policy Infrastructure Controller interface used in its Nexus 9000 Series Switches that could be potentially abused to read or write arbitrary files on a vulnerable system.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/62_Sa5DBHuY/cisco-issues-patch-for-critical.html