Weak randomness and a race condition in the AnyConnect VPN login process on Meraki MX and Z Series devices let a remote attacker without credentials hijack or block another user’s VPN session.
Posts tagged: Cisco
Cisco Nexus Dashboard Fabric Controller SSH Host Key Validation Vulnerability
Cisco NDFC fails to properly validate SSH host keys when talking to the switches it manages, letting a network-positioned attacker impersonate a device and harvest the credentials NDFC uses to log in.
Cisco Secure Network Analytics Manager API Authorization Vulnerability
A low-privileged authenticated user can abuse an under-protected API in Cisco Secure Network Analytics Manager to fabricate findings, letting them mask real alerts or trigger false ones.
Cisco Secure Network Analytics Manager Privilege Escalation Vulnerability
An authenticated administrator on Cisco Secure Network Analytics Manager or its virtual variant can send crafted input to the web management interface and run arbitrary commands as root on the host OS.
Cisco Unified Communications Products Command Injection Vulnerability
An authenticated CLI administrator on several Cisco Unified Communications platforms can craft command arguments that break out to root on the underlying OS, with no workaround available.
Cisco Unified Communications Products Privilege Escalation Vulnerability
An attacker with ESXi hypervisor admin rights can escalate from the restricted shell of several Cisco Unified Communications and Contact Center virtual appliances straight to root on the guest OS.
Cisco Unified Contact Center Enterprise Cloud Connect Insufficient Access Control
Cisco’s Cloud Connect component in Unified Contact Center Enterprise accepts crafted TCP data on a specific port with no authentication check, letting a remote attacker read or alter data on the device.
Cisco Unified Intelligence Center Privilege Escalation Vulnerabilities
Two flaws in Cisco Unified Intelligence Center let anyone already logged in with a low-privilege account reach reporting data and functions meant for other roles, affecting every contact-centre product that bundles the tool.
Cisco Unified Intelligent Contact Management Enterprise Cross-Site Scripting
A stored input-validation flaw in Cisco ICM Enterprise’s web management interface lets an attacker run script in an administrator’s browser session if tricked into clicking a crafted link.
Cisco Webex Meetings Services HTTP Cache Poisoning Vulnerability
An unauthenticated attacker could poison cached HTTP responses in Cisco Webex Meetings’ cloud-based join service, causing some clients to receive incorrect responses when connecting to a meeting.