This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Cisco fixes 8 vulnerabilities in various products
Cisco fixes 8 vulnerabilities in various products. Individual products and their fixed versions: Cisco Application Policy Infrastructure Controller (APIC) - 6.0(8e), 6.1(2f) [1]. Cisco BroadWorks Call Center - 24_2025.01_1.310, 26_2025.01_1.310 [2] Cisco BroadWorks BroadWorks - 24_2025.01_1.310, 26_2025.01_1.310 [2] Cisco AsyncOS (Secure Email Gateway) - 16-0-0-054 [3] The remaining fixed versions can be obtained at [4], where on the first page you need to enter the type and version of your product. On the next page, select all impact ratings and all security advisories. On the last page, select the highest of the displayed fixed versions and update your affected product to it.
An authenticated remote attacker with administrator privileges can execute commands in the operating system on Nexus 3000 and 9000 series switches (standalone NX-OS mode) [5].
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
More information:
- CVE-2025-20161 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 26. 2. 2025.
An unauthenticated adjacent attacker can carry out a DoS attack on Nexus 3000 and 9000 series switches (standalone NX-OS mode). Information about a potential temporary fix can be found at [6].
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
More information:
- CVE-2025-20111 at cve.org, NVD
- CWE-1220: Insufficient Granularity of Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 26. 2. 2025.
An authenticated local attacker with administrator privileges can cause a DoS attack [1].
The vulnerability is present in product:
- Cisco APIC; <5.4; >=6.0, <6.0(8e); >=6.1, <6.1(2f);
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
More information:
- CVE-2025-20119 at cve.org, NVD
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') at cwe.mitre.org
The vulnerability was publicly disclosed 26. 2. 2025.
An authenticated local attacker with administrator privileges can execute commands in the operating system with "root" privileges in APIC [1].
The vulnerability is present in product:
- Cisco APIC; <5.4; >=6.0, <6.0(8e); >=6.1, <6.1(2f);
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
More information:
- CVE-2025-20117 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 26. 2. 2025.
An authenticated remote attacker with administrator privileges can carry out an XSS attack in APIC [1].
The vulnerability is present in product:
- Cisco APIC; <5.4; >=6.0, <6.0(8e); >=6.1, <6.1(2f);
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2025-20116 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 26. 2. 2025.
An authenticated local attacker with administrator privileges can access sensitive information without authorization in APIC [1].
The vulnerability is present in product:
- Cisco APIC; <5.4; >=6.0, <6.0(8e); >=6.1, <6.1(2f);
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2025-20118 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 26. 2. 2025.
An unauthenticated remote attacker can cause an XSS attack in BroadWorks Call Center and Receptionist [2].
The vulnerability is present in products:
- Cisco BroadWorks Call Center; >=24.0, <24_2025.01_1.310; >=25.0, <26_2025.01_1.310;
- Cisco BroadWorks Receptionis; >=24.0, <24_2025.01_1.310; >=25.0, <26_2025.01_1.310;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2025-20211 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 19. 2. 2025.
An unauthenticated remote attacker can bypass the security check of e-mail messages in Secure Email Gateway [3].
The vulnerability is present in product:
- Cisco AsyncOS; <16-0-0-054;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
More information:
- CVE-2025-20153 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 19. 2. 2025.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-multi-vulns-9ummtg5
- [2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-GDPgJ58P
- [3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-mailpol-bypass-5nVcJZMw
- [4] https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
- [5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ici-dpOjbWxk
- [6] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3kn9k-healthdos-eOqSWK4g
By CESNET, z.s.p.o. Martin Krajči on 28. 2. 2025.