Security News > 2022 > May > F5, Cisco admins: Stop what you're doing and check if you need to install these patches

F5 Networks and Cisco this week issued warnings about serious, and in some cases critical, security vulnerabilities in their products.

"This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services," as F5 put it in its advisory.

"The vulnerabilities are not dependent on one another," Cisco's Product Security Incident Response Team added in its advisory.

"Exploitation of one of the vulnerabilities is not required to exploit another vulnerability. In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities."

For its part, Cisco detailed three vulnerabilities - tracked as CVE-2022-20777, CVE-2022-20779, and CVE-2022-20780, found by a team calling itself the Orange Group - in its Enterprise NFVIS, which enables virtual network functions to be managed independently.

"An attacker could exploit this vulnerability by persuading an administrator to import a crafted file that will read data from the host and write it to any configured VM," Cisco PSIRT wrote.

News URL

https://go.theregister.com/feed/www.theregister.com/2022/05/06/cisco-f5-networking-vulnerabilities/