This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco fixes 26 vulnerabilities in its products
Cisco fixes 26 vulnerabilities in its products. The most severe of them are listed below; the rest can be found at the link [1]. Products and their fixed versions: Cisco Unified Industrial Wireless Software - 17.15.1 Cisco Nexus Dashboard Fabric Controller (NDFC) - 12.2.1 Cisco Enterprise Chat and Email (ECE) - 12.5(1) ES9 and 12.6(1) ES9 ET3 Cisco Unified Communications Manager IM & Presence (CM IM&P) - 12.5(1)SU9, 14SU5 (2025) and 15SU2 Cisco Identity Services Engine (ISE) - fixes for the individual vulnerabilities can be found at [2][3] Cisco Unified Communications Manager (CM) and Unified CM Session Management Edition (CM SME) - 14SU5 (2025) and 15SU2
An unauthenticated remote attacker is able, by sending specifically crafted HTTP requests in Unified Industrial Wireless Software, to execute commands with root privileges in the operating system of the affected device. The vulnerability affects Catalyst IW9165D Heavy Duty Access Points, Catalyst IW9165E Rugged Access Points and Wireless Clients, and Catalyst IW9167E Heavy Duty Access Points with Ultra-Reliable Wireless Backhaul (URWB) mode enabled. Whether this mode is active can be verified with the command "show mpls-config". If this command is available, the mode is active [4].
The vulnerability is present in product:
- Cisco Unified Industrial Wireless Software; <=17.14; >=17.15, <17.15.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-20418 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
An authenticated remote attacker with "read-only" permissions is able, by sending specifically crafted requests to a particular REST API endpoint or the NDFC web management interface, to execute SQL commands, which may lead to modification, reading or deletion of data in the internal database and endanger the availability of the device. If NDFC is configured for storage area network (SAN) mode, the device is not affected [5].
The vulnerability is present in product:
- Cisco Nexus Dashboard Fabric Controller; ==12.1.2; ==12.1.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-20536 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
An unauthenticated remote attacker is able, by sending specially crafted Media Routing Peripheral Interface Manager (MR PIM) traffic in ECE, to carry out a DoS attack on the External Agent Assignment Service (EAAS), which may prevent the start of a chat, a callback or a delayed callback. The vulnerability affects only systems with the EAAS service running. To verify its configuration, go to "Partitions" > "Partition" > "Services" > "Unified CCE" > "EAAS" > "Instances" in the "System Console" and check whether the EAAS instance is active [6].
The vulnerability is present in product:
- Cisco Enterprise Chat and Email;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-20484 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
An authenticated remote attacker is able, through unauthorized access to certain logs in Unified CM IM&P, to view stored cleartext credentials, which may lead to the leakage of potentially sensitive information. The vulnerability affects systems running the External Database Merge Tool [7].
The vulnerability is present in product:
- Cisco Unified Communications Manager IM & Presence;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-20457 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
An authenticated remote attacker with "Read-Only Administrator" privileges is able, due to insufficient authorization checks in ISE, to gain access to administrative functions beyond their privileges using specially crafted HTTP requests [2].
The vulnerability is present in product:
- Cisco Identity Services Engine; <3.1P9; >=3.2, <3.2P7; >=3.3, <3.3P3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2024-20537 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
An unauthenticated remote attacker is able, using social engineering methods, to carry out an XSS attack in ISE [3].
The vulnerability is present in product:
- Cisco Identity Services Engine; <3.1P10; >=3.2, <3.2P7; >=3.3, <3.3P4; >=3.4, <3.4P1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2024-20525 at cve.org, NVD
- CVE-2024-20530 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
An unauthenticated remote attacker is able, using social engineering methods, to carry out an XSS attack in ISE [2].
The vulnerability is present in product:
- Cisco Identity Services Engine; <3.1P10; >=3.2, <3.2P7; >=3.3, <3.3P4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2024-20538 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
An unauthenticated remote attacker is able, using social engineering methods, to carry out an XSS attack in Unified CM and Unified CM SME [8].
The vulnerability is present in products:
- Cisco Unified Communications Manager; <14SU5; >=15, <15SU2;
- Cisco Unified Communications Manager Session Management Edition; <14SU5; >=15, <15SU2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2024-20511 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
An authenticated remote attacker with "Super Admin" privileges is able, by sending a specially crafted API request in ISE, to read and delete arbitrary files in the operating system of the affected device [3].
The vulnerability is present in product:
- Cisco Identity Services Engine; <3.1P10; >=3.2, <3.2P7; >=3.3, <3.3P4; >=3.4, <3.4P1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
More information:
- CVE-2024-20527 at cve.org, NVD
- CVE-2024-20529 at cve.org, NVD
- CVE-2024-20532 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
An authenticated remote attacker with "Super Admin" privileges is able, by sending a specially crafted API request in ISE, to read arbitrary files in the operating system of the affected device or to carry out an SSRF attack [3].
The vulnerability is present in product:
- Cisco Identity Services Engine; <3.1P10; >=3.2, <3.2P7; >=3.3, <3.3P4; >=3.4, <3.4P1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
More information:
- CVE-2024-20531 at cve.org, NVD
- CWE-611: Improper Restriction of XML External Entity Reference at cwe.mitre.org
The vulnerability was publicly disclosed 6. 11. 2024.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/publicationListing.x
- [2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-BBRf7mkE
- [3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy
- [4] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-backhaul-ap-cmdinj-R7E28Ecs
- [5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-sqli-CyPPAxrL
- [6] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-dos-Oqb9uFEv
- [7] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-inf-disc-cUPKuA5n
- [8] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-SVCkMMW
By CESNET, z.s.p.o. Michaela Ručková on 14. 11. 2024.