Cisco patches critical bugs in collaboration products

Cisco has patched two critical bugs that could allow attackers to write files and operate arbitrary code on its movie conferencing and collaboration merchandise.

Every bug influences the firm’s Cisco Expressway collection of collaboration servers and its TelePresence Online video Conversation Server (VCS).

The initially vulnerability, CVE-2022-20754, lets a remote attacker to compose files to the procedure. It lies in the products’ cluster databases API, which does not properly validate user input. This enables attackers to authenticate as an administrative person and then submit malicious input by way of a listing traversal attack. They could then generate their own files with root privileges, which includes overwriting current working method files.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The next flaw, CVE-2022-20755, lets an attacker to execute arbitrary code by exploiting the products’ web management interface. An attacker could log in as an admin and then craft destructive input that would let them run their own code as root.

These vulnerabilities, just about every of which has a 9. CVSS score, do not depend on just about every other, Cisco reported in its advisory. with buyers remaining advised to put in both equally patches to defend their methods.

Cisco Expressway is a series of products supporting collaboration with consumers outdoors of a company’s firewall. The method, which operates without having the require for a VPN consumer, supports video clip, voice, and fast messaging. End users can also see just about every others’ presence details.

The TelePresence VCS is a server for running video clip conferencing periods. It will work as an appliance on a customer’s premises or in the cloud, and supports conversation amongst diverse movie conferencing platforms.

TelePresence VCS has not been offered given that December 2020. Cisco will quit issuing software upkeep patches for this merchandise on December 29 this 12 months and will halt supplying support totally at the close of 2023.