Cisco has stomped out a slew of high-severity vulnerabilities across its lineup of network-security products. The most severe flaws can be exploited by an unauthenticated, remote attacker to launch a passel of malicious attacks — from denial of service (DoS) to cross-site request forgery (CSRF).
The vulnerabilities exist in Cisco’s Firepower Threat Defense (FTD) software, which is part of its suite of network-security and traffic-management products; and its Adaptive Security Appliance (ASA) software, the operating system for its family of ASA corporate network-security devices.
“The Cisco Product Security Incident Response Team is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory,” according to Cisco in an update released on Wednesday.
The most severe of these flaws includes a vulnerability in Cisco Firepower Chassis Manager (FCM), which exists in the Firepower Extensible Operating System (FXOS) and provides management capabilities.
The flaw (CVE-2020-3456) ranks 8.8 out of 10 on the CVSS scale, and stems from insufficient CSRF protections in the FCM interface. It could be exploited to enable CSRF — which means that when attackers are authenticated on the server, they also have control over the client.
“An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link,” according to Cisco. “A successful exploit could allow the attacker to send arbitrary requests that could take unauthorized actions on behalf of the targeted user.”
Cisco FXOS Software is affected when it is running on Firepower 2100 Series Appliances (when running ASA Software in non-appliance mode), Firepower 4100 Series Appliances and Firepower 9300 Series Appliances.
Four other high-severity vulnerabilities across Cisco’s Firepower brand could be exploited by an unauthenticated, remote attacker to cripple affected devices with a DoS condition. These include a flaw in Firepower’s Management Center Software (CVE-2020-3499), Cisco Firepower 2100 Series firewalls (CVE-2020-3562), Cisco Firepower 4110 appliances (CVE-2020-3571) and Cisco Firepower Threat Defense Software (CVE-2020-3563 and CVE-2020-3563).
Cisco also patched multiple DoS flaws in its Adaptive Security Appliance software, including ones tied to CVE-2020-3304, CVE-2020-3529, CVE-2020-3528, CVE-2020-3554, CVE-2020-3572and CVE-2020-3373 that could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly.
Another flaw of note, in the web services interface of Cisco Adaptive Security Appliance and Firepower Threat Defense, could allow an unauthenticated, remote attacker to upload arbitrary-sized files to specific folders on an affected device, which could lead to an unexpected device reload.
The flaw stems from the software not efficiently handling the writing of large files to specific folders on the local file system.
The new security alerts come a day after Cisco sent out an advisory warning that a flaw (CVE-2020-3118) the Cisco Discovery Protocol implementation for Cisco IOS XR Software was being actively exploited by attackers. The bug, which could be exploited by unauthenticated, adjacent attackers, could allow them to execute arbitrary code or cause a reload on an affected device.
