Cisco has released software updates to address four security vulnerabilities in its software that could be weaponized by malicious actors to take control of affected systems.
The most critical of the flaws is CVE-2022-20650 (CVSS score: 8.8), which relates to a command injection flaw in the NX-API feature of Cisco NX-OS Software that stems from a lack of sufficient input validation of user-supplied data.
“An attacker could exploit this vulnerability by sending a crafted HTTP POST request to the NX-API of an affected device,” Cisco said. “A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system.”
The flaw impacts Nexus 3000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, and Nexus 9000 Series Switches in standalone NX-OS mode running Cisco NX-OS Software that have the NX-API feature enabled.
Also patched are two high-severity denial-of-service (DoS) bugs in NX-OS – CVE-2022-20624 and CVE-2022-20623 (CVSS scores: 8.6) – found in the Cisco Fabric Services Over IP (CFSoIP) and Bidirectional Forwarding Detection (BFD) traffic functions.
CVE-2022-20624, which was reported to Cisco by the U.S. National Security Agency (NSA), impacts Nexus 3000 and 9000 Series Switches and UCS 6400 Series Fabric Interconnects, assuming CFSoIP is enabled. CVE-2022-20623, on the other hand, only affects Nexus 9000 Series Switches that have BFD toggled on.
Lastly, the networking equipment maker also patched a third DoS vulnerability (CVE-2022-20625, CVSS score: 4.3) in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software, which could “allow an unauthenticated, adjacent attacker to cause the service to restart, resulting in a denial of service (DoS) condition.”
Cisco said that it’s not aware of “any public announcements or malicious use” of the aforementioned vulnerabilities. That said, it’s recommended that users move quickly to apply the necessary updates to prevent potential real-world exploitation.
