Cisco sysadmins could be facing a busy weekend, with the networking giant overnight announcing more than 20 fixes for security vulnerabilities.
Only two of the company’s advisories are rated “critical”: a management interface authentication bypass in its wireless LAN management software (Common Vulnerabilities and Exposures entry CVE-2022-20695); and the latest update to Cisco’s Spring Framework vulnerability response (Common Vulnerabilities and Exposures entry CVE-2022-22965).
The Cisco Wireless LAN Controller software bug could allow an attacker to log into the management interface using crafted credentials.
A mistake in the password validation algorithm may allow an attacker to log into the device as an admin, the advisory stated.
“The attacker could obtain privileges that are the same level as an administrative user but it depends on the crafted credentials,” Cisco continued.
The attack affects Cisco WLC Software Release 18.104.22.168 or Release 22.214.171.124, with a specific Radius configuration selected.
These software releases could be present in the management interfaces of the company’s 3504, 5520, and 8540 wireless controllers, Mobility Express, and Virtual Wireless Controller.
Free software updates have been shipped to patch the software.
Most fixes will ship during April and May, although some customers will be waiting until June, and only Cisco DNA Center and the Cisco software-defined AVC customers are still awaiting a fix date.
Lower-rated alerts make up the bulk of the remaining patches.
The advisories list a further seven vulnerabilities rated “high”, and nine rated “medium”.