Cisco Patches 34 Flaws, Including Secure Client Privilege Escalation
Cisco's October round covers Expressway Series, IOS XR, Snort 3 and Unified Communications, plus a local privilege escalation in Secure Client's Secure Firewall Posture module.
Cisco announced patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3 and its Unified Communications products, SecurityWeek reported. Cisco said it was not aware of any of them being exploited in the wild.
The Expressway Series received fixes for 10 vulnerabilities, including a critical-severity remote code execution bug. According to Cisco, persistent cookies and insufficient validation of client certificates in certain configurations could let attackers connect to the database service and invoke specific remote procedure call commands. The flaws were fixed in Expressway Series version X15.5.20.
Nine CVEs were patched in Unified Communications products, including Emergency Responder, Unified Communications Manager and Unity Connection. Three of them are critical-severity issues grouping multiple improper resource control, improper authentication and improper input neutralization holes.
Snort 3 got fixes for 13 CVEs, included in Snort 3 version 3.12.4.0 and in updates for Cyber Vision, Meraki MX, Secure Firewall ASA and other products.
Cisco also fixed a high-severity denial-of-service bug in IOS XR and a high-severity privilege escalation in Secure Client's Secure Firewall Posture module. Cisco's advisory for that flaw describes an authenticated local attacker sending crafted interprocess communication messages to a local socket, with limited file writes at SYSTEM or root level. Cisco rated the advisory High rather than Medium because the bug could yield full root on macOS and Linux.
Defenders should identify exposed Expressway and Unified Communications systems and apply the listed releases.
CVE references
Sources
- Cisco Patches 34 Vulnerabilities Across Multiple ProductsPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning