Cisco next to turn up Spring4Shell-vulnerable products

Cisco has joined the list of technology vendors identifying products carrying the Spring4Shell vulnerability.

Considering its vast product list, it will some time before the extent of its exposure is known, but the networking giant’s investigations have found eight products that will need remediation so far.

They are the CX Cloud agent software, Crosswork Optimisation Engine, Crosswork Zero Touch Provisioning, Edge Intelligence, WAN Automation Engine and WAN Automation Engine Live, Enterprise Chat and Email, and Virtualised Voice Browser.

Fixes are not yet available, with Cisco’s out-of-cycle advisory noting that the vendor “is continuing to evaluate the fix and will update the advisory as additional information becomes available”.

The advisory lists a further 70 products still under investigation.

Spring4Shell was first disclosed by VMware at the end of March, and exploit attempts began almost immediately.

Vendors already announcing patches for downstream products include VMware, PTC, and Jamf.

Spring4Shell is a ClassLoader access vulnerability related to the data binding used to populate an object from request parameters such as queries or forms. 

So far, the vulnerability is assessed as difficult to exploit, since it requires a vulnerable application to run on Apache Tomcat as a WAR (web application resource) deployment.