Cisco has patched multiple Critical vulnerabilities in NX-OS and Application Services Engine (ASE) products.
An attacker could remotely exploit some of these vulnerabilities to take control of an impacted system.
NX-OS vulnerabilities
Cisco patched one Critical vulnerability CVE-2021-1361 in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches. The issue occurs when running NX-OS software in standalone mode.
As a result, a remote unauthenticated attacker could “create, delete, or overwrite arbitrary files with root privileges on the device.”
“This vulnerability exists because TCP port 9075 is incorrectly configured to listen and respond to external connection requests. An attacker could exploit this vulnerability by sending crafted TCP packets to an IP address that is configured on a local interface on TCP port 9075,” Cisco warned in the advisory.
The vulnerability has a very high CVSS base score of 9.8, so should be prioritized for patching.
ASE vulnerabilities
Moreover, Cisco also issued two Critical security updates related to the Application Services Engine (ASE).
The first patch addresses two Critical vulnerabilities (CVE-2021-1393 and CVE-2021-1396) in ASE that could allow an unauthenticated, remote attacker to gain privileged access to host-level operations. Moreover, a bad actor could also “learn device-specific information, create diagnostic files, and make limited configuration changes.”
The advisory sports a CVSS base score of 9.8.
In a second security advisory, Cisco fixed a vulnerability CVE-2021-1388 in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine. If left unpatched, this flaw could allow an unauthenticated, remote attacker to bypass authentication on an affected Cisco device.
“The vulnerability is due to improper token validation on a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted request to the affected API,” Cisco warned in the advisory.
This issue CVE-2021-1388 has the highest CVSS score possible of 10. Both of the ASE patches should also be high priority for patching.
Other vulnerabilities
Finally, Cisco also patched a number of other vulnerabilities to include the following High severity vulnerabilities:
- CVE-2021-1228: Cisco Nexus 9000 Series Fabric Switches ACI Mode Fabric Infrastructure VLAN Unauthorized Access Vulnerability
- CVE-2021-3156: Sudo Privilege Escalation Vulnerability Affecting Cisco Products: January 2021
Of special note, the sudo vulnerability advisory CVE-2021-3156 updated the lists of vulnerable products and products confirmed not vulnerable.
Finally, three other Medium vulnerabilities were also addressed for Cisco Identity Services Engine and Identity Services Engine (ISE) products.
Readers can check out the latest Cisco advisories as of February 26, 2021. System and Network administrators should deploy security updates to affected devices as soon as possible.