Cisco and VMware Release Security Updates to Patch Critical Flaws in their Products

Cisco and VMware have released security updates to tackle critical security flaws in their products that could be exploited by malicious actors to execute arbitrary code on affected techniques.

The most serious of the vulnerabilities is a command injection flaw in Cisco Industrial Network Director (CVE-2023-20036, CVSS score: 9.9), which resides in the web UI ingredient and arises as a end result of poor input validation when uploading a Product Pack.

“A profitable exploit could permit the attacker to execute arbitrary instructions as NT AUTHORITYSYSTEM on the underlying functioning process of an afflicted system,” Cisco said in an advisory launched on April 19, 2023.

The networking devices significant also fixed a medium-severity file permissions vulnerability in the identical products (CVE-2023-20039, CVSS score: 5.5) that an authenticated, neighborhood attacker could abuse to perspective sensitive information.

Patches have been created accessible in variation 1.11.3, with Cisco crediting an unnamed “external” researcher for reporting the two issues.

Also fixed by Cisco is one more critical flaw in the external authentication mechanism of the Modeling Labs network simulation system. Tracked as CVE-2023-20154 (CVSS score: 9.1), the vulnerability could allow an unauthenticated, distant attacker to accessibility the web interface with administrative privileges.

“To exploit this vulnerability, the attacker would want valid consumer qualifications that are saved on the involved exterior authentication server,” the corporation noted.

“If the LDAP server is configured in these kinds of a way that it will reply to lookup queries with a non-empty array of matching entries (replies that incorporate lookup final result reference entries), this authentication bypass vulnerability can be exploited.”

Although there are workarounds that plug the security hole, Cisco cautions prospects to take a look at the usefulness of these kinds of remediations in their personal environments prior to administering them. The shortcoming has been patched with the release of model 2.5.1.

VMware ships updates for Aria Functions for Logs

VMware, in an advisory introduced on April 20, 2023, warned of a critical deserialization flaw impacting various versions of Aria Operations for Logs (CVE-2023-20864, CVSS rating: 9.8).

Upcoming WEBINARDefend with Deception: Advancing Zero Believe in Security

Find out how Deception can detect superior threats, end lateral motion, and boost your Zero Believe in method. Sign up for our insightful webinar!

Help save My Seat!

“An unauthenticated, destructive actor with network access to VMware Aria Functions for Logs may well be capable to execute arbitrary code as root,” the virtualization products and services supplier claimed.

VMware Aria Functions for Logs 8.12 fixes this vulnerability together with a superior-severity command injection flaw (CVE-2023-20865, CVSS score: 7.2) that could allow for an attacker with admin privileges to run arbitrary instructions as root.

“CVE-2023-20864 is a critical issue and ought to be patched promptly,” the company said. “It desires to be highlighted that only model 8.10.2 is impacted by this vulnerability.”

The alert arrives pretty much a few months immediately after VMware plugged two critical issues in the very same item (CVE-2022-31704 and CVE-2022-31706, CVSS scores: 9.8) that could consequence in remote code execution.

With Cisco and VMware appliances turning out to be rewarding targets for threat actors, it’s advised that end users shift immediately to use the updates to mitigate possible threats.

Discovered this report fascinating? Abide by us on Twitter  and LinkedIn to browse much more exceptional articles we put up.

Some elements of this write-up are sourced from:
thehackernews.com