Cisco Patches 11 High-Severity Vulnerabilities in Security Products
Cisco this week announced the release of its April 2022 bundle of security advisories for Cisco Adaptive Security Appliance (ASA), Firepower Threat Defense (FTD), and Firepower Management Center (FMC).
The semiannual bundled advisories describe a total of 19 vulnerabilities in Cisco’s security products, including 11 that were assessed with a severity rating of “high.”
The most severe of these is CVE-2022-20746 (CVSS score of 8.8), an FTD security hole that exists because TCP flows aren’t properly handled, and which could be exploited remotely without authentication to cause a denial of service (DoS) condition.
“An attacker could exploit this vulnerability by sending a crafted stream of TCP traffic through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition,” Cisco explains in an advisory.
The tech giant has addressed the issue with the release of FDT versions 126.96.36.199 and 188.8.131.52. The company also plans the inclusion of fixes in FDT releases 184.108.40.206 and 7.0.2, which are planned for next month.
Several other DoS vulnerabilities were resolved with the same FDT releases, all rated “high severity,” including some that impact ASA as well. They were addressed in ASA releases 220.127.116.11, 9.14.4, 18.104.22.168, 22.214.171.124, and 126.96.36.199.
Other issues addressed with these software updates could lead to privilege escalation or to the tampering of data transmitted across an IPsec IKEv2 VPN tunnel.
Cisco also resolved an ASA-specific vulnerability that allows an attacker to retrieve process memory containing sensitive information.
This week, the tech giant also announced that Firepower Management Center (FMC) releases 188.8.131.52 and 184.108.40.206 – along with the upcoming releases 220.127.116.11 and 7.0.2 – resolve a remotely exploitable security protection bypass vulnerability.
“An attacker could exploit this vulnerability by uploading a maliciously crafted file to a device running affected software. A successful exploit could allow the attacker to store malicious files on the device, which they could access later to conduct additional attacks, including executing arbitrary code on the affected device with root privileges,” Cisco says.
The company’s semiannual bundled publication of security advisories also details patches for eight medium-severity flaws in these security products.
Cisco is not aware of any attacks exploiting these vulnerabilities.