Cisco released four software updates in order to fix security flaws in its software. These vulnerabilities could allow malicious actors to gain control over affected systems.
The most critical of the flaws is CVE-2022-20650 (CVSS score: 8. 8), which relates to a command injection flaw in the NX-API feature of Cisco NX-OS Software that stems from a lack of sufficient input validation of user-supplied data.
” An attacker could use this vulnerability to send a specially crafted HTTP request to an NX-API device. Cisco stated. An attacker could use a successful exploit to run arbitrary commands on an operating system with root privileges. “
The flaw impacts Nexus 3000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, and Nexus 9000 Series Switches in standalone NX-OS mode running Cisco NX-OS Software that have the NX-API feature enabled.
Also patched are two high-severity denial-of-service (DoS) bugs in NX-OS – CVE-2022-20624 and CVE-2022-20623 (CVSS scores: 8. 6) – found in the Cisco Fabric Services Over IP (CFSoIP) and Bidirectional Forwarding Detection (BFD) traffic functions.
CVE-2022-20624, which was reported to Cisco by the U.S. National Security Agency (NSA), impacts Nexus 3000 and 9000 Series Switches and UCS 6400 Series Fabric Interconnects, assuming CFSoIP is enabled. CVE-2022-20623, on the other hand, only affects Nexus 9000 Series Switches that have BFD toggled on.
Lastly, the networking equipment maker also patched a third DoS vulnerability (CVE-2022-20625, CVSS score: 4. 3) in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software, which could “allow an unauthenticated, adjacent attacker to cause the service to restart, resulting in a denial of service (DoS) condition. “
Cisco said that it’s not aware of “any public announcements or malicious use” of the aforementioned vulnerabilities. That said, it’s recommended that users move quickly to apply the necessary updates to prevent potential real-world exploitation.