Cisco sysadmins could be facing a busy weekend, with the networking giant overnight announcing more than 20 fixes for security vulnerabilities.
Only two of the company’s advisories are rated “critical”: a management interface authentication bypass in its wireless LAN management software (Common Vulnerabilities and Exposures entry CVE-2022-20695); and the latest update to Cisco’s Spring Framework vulnerability response (Common Vulnerabilities and Exposures entry CVE-2022-22965).
The Cisco Wireless LAN Controller software bug could allow an attacker to log into the management interface using crafted credentials.
A mistake in the password validation algorithm may allow an attacker to log into the device as an admin, the advisory stated.
“The attacker could obtain privileges that are the same level as an administrative user but it depends on the crafted credentials,” Cisco continued.
The attack affects Cisco WLC Software Release 8.10.151.0 or Release 8.10.162.0, with a specific Radius configuration selected.
These software releases could be present in the management interfaces of the company’s 3504, 5520, and 8540 wireless controllers, Mobility Express, and Virtual Wireless Controller.
Free software updates have been shipped to patch the software.
In its other critical advisory, Cisco has announced dates when products identified as impacted by the Spring Framework vulnerability will be patched.
Most fixes will ship during April and May, although some customers will be waiting until June, and only Cisco DNA Center and the Cisco software-defined AVC customers are still awaiting a fix date.
Lower-rated alerts make up the bulk of the remaining patches.
The company’s SD-WAN software has a privilege escalation bug and an access control bug, both patched.
Various versions of Cisco’s IOS and IOS XE operating systems are vulnerable to three denial of service vulnerabilities, and one privilege escalation vulnerability.
The advisories list a further seven vulnerabilities rated “high”, and nine rated “medium”.
