Cisco Releases Security Patches for TelePresence, RoomOS and Umbrella VA

Networking devices maker Cisco has produced security updates to handle a few high-severity vulnerabilities in its products that could be exploited to result in a denial-of-services (DoS) affliction and take management of afflicted techniques.

The first of the three flaws, CVE-2022-20783 (CVSS score: 7.5), affects Cisco TelePresence Collaboration Endpoint (CE) Software program and Cisco RoomOS Software package, and stems from a lack of suitable input validation, allowing an unauthenticated, remote attacker to mail specially crafted website traffic to the products.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“A effective exploit could enable the attacker to trigger the impacted product to either reboot typically or reboot into routine maintenance mode, which could result in a DoS problem on the machine,” the organization mentioned in an advisory.

Credited with getting and reporting the flaw is the U.S. National Security Company (NSA). The issue has been dealt with in Cisco TelePresence CE Computer software versions 9.15.10.8 and 10.11.2.2.

CVE-2022-20773 (CVSS rating: 7.5), the second flaw to be patched, concerns a static SSH host key that is current in Cisco Umbrella Virtual Appliance (VA) managing a program edition previously than 3.3.2, most likely permitting an attacker to conduct a male-in-the-middle (MitM) attack on an SSH relationship and hijack the administrator credentials.

A third significant-severity vulnerability is a case of privilege escalation in Cisco Virtualized Infrastructure Manager (CVE-2022-20732, CVSS score: 7.8) that grants an authenticated, area attacker to escalate privileges on gadgets. It’s been solved in variation 4.2.2 of the software.

“A profitable exploit could make it possible for the attacker to acquire inner database qualifications, which the attacker could use to watch and modify the contents of the database. The attacker could use this access to the database to elevate privileges on the afflicted device,” the company stated.

Also addressed by Cisco are 10 medium-severity bugs spanning its product or service portfolio, such as Webex Meeting, Unified Communications Merchandise, Umbrella Secure Web Gateway, and IOS XR Program.

Found this post attention-grabbing? Adhere to THN on Facebook, Twitter  and LinkedIn to read extra unique information we submit.