Cisco has patched three Critical vulnerabilities in Cisco Integrated Management Controller (IMC), DNA Spaces Connector and IoT Field Network Director (FND) products.
An attacker could exploit these vulnerabilities to access sensitive information or execute remote code.
IMC RCE (CVE-2020-3470)
The first patch addresses a Cisco Integrated Management Controller (IMC) API subsystem Critical remote code execution (RCE) vulnerability CVE-2020-3470.
This vulnerability could allow an unauthenticated hacker to remotely execute arbitrary code with root privileges.
“The vulnerabilities are due to improper boundary checks for certain user-supplied input. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the API subsystem of an affected system. When this request is processed, an exploitable buffer overflow condition may occur,” Cisco explained in the advisory.
To add, the issue affects 5000 Series Enterprise Network Compute System (ENCS) Platforms and multiple UCS server models.
DNA Spaces Connector command injection (CVE-2020-3586)
The second patch addresses a Cisco DNA Spaces Connector command injection vulnerability CVE-2020-3586.
This vulnerability could allow an unauthenticated hacker to remotely execute arbitrary commands on an affected device.
“The vulnerability is due to insufficient validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface,” Cisco warned.
“A successful exploit could allow the attacker to execute arbitrary commands on the underling operating system with privileges of the web-based management application, which is running as a restricted user.”
Moreover, the issue affects Cisco DNA Spaces Connector software releases 2.2 and earlier.
IoT FND unauthenticated REST API (CVE-2020-3531)
Finally, the third patch addresses an Field Network Director (FND) unauthenticated REST API CVE-2020-3531.
This vulnerability could allow an unauthenticated hacker to remotely access the back-end database of an affected system.
“The vulnerability exists because the affected software does not properly authenticate REST API calls. An attacker could exploit this vulnerability by obtaining a cross-site request forgery (CSRF) token and then using the token with REST API requests,” Cisco stated in the advisory.
This issue affects Cisco IoT FND releases earlier than Release 4.6.1.
Readers can check out the latest Cisco advisories as of November 18, 2020. System and Network administrators should deploy security updates to affected devices as soon as possible.