On Wednesday, Cisco released patches for a serious command injection vulnerability in the IOx application hosting environment. This vulnerability, tracked as CVE-2023-20076, is caused by parameters that are not completely sanitized when activating an application. If exploited, an attacker could execute arbitrary commands as root on the underlying host operating system. The bug bypasses measures to prevent malicious code from persisting across reboots and system resets. It affects all Cisco devices running IOS XE Software with the IOx feature enabled, if they do not support native docker, including 800 series industrial ISRs, Catalyst Access Points, CGR1000 compute modules, IC3000 industrial compute gateways, and IR510 WPAN industrial routers. Trellix, the cybersecurity firm that discovered the vulnerability, also identified a security check bypass during tar archive extraction, which could allow an attacker to write on the underlying host operating system as root. However, this issue cannot be exploited. Cisco also issued patches for several medium-severity bugs impacting Identity Services Engine and Prime Infrastructure Software, and warned of a medium-severity file upload issue impacting RV340, RV340W, RV345, and RV345P routers.
Cisco has released updates to address the high-severity command injection vulnerability in the IOx application hosting environment. This vulnerability, tracked as CVE-2023-20076, could allow malicious code to persist across reboots and system resets. It affects all Cisco devices running IOS XE Software with the IOx feature enabled, if they do not support native docker. Trellix, the cybersecurity firm that discovered the vulnerability, also identified a security check bypass during tar archive extraction, which could allow an attacker to write on the underlying host operating system as root. Cisco has released security updates for the impacted industrial ISRsM7), COS-APs, IC3000 gateways, and for IOS XE-based devices configured with IOx. Updates for CGR1000 compute modules and IR510 WPAN industrial routers are planned for February 2023. In addition, Cisco has issued patches for several medium-severity bugs impacting Identity Services Engine and Prime Infrastructure Software, and warned of a medium-severity file upload issue impacting RV340, RV340W, RV345, and RV345P routers. Customers are advised to update their Cisco products as soon as possible.
This Cyber News was published on www.securityweek.com. Publication date: Thu, 02 Feb 2023 16:35:03 +0000