Cisco informed its customers this week that Prime Data Center Network Manager (DCNM) is affected by two critical vulnerabilities that can be exploited for remote code execution and access to the product's management console.
One of the vulnerabilities identified (CVE-2017-6639) is related to a lack of authentication and authorization for a debugging tool that was inadvertently left enabled.
A remote, unidentified attacker could exploit this vulnerability to gain access to sensitive information or execute arbitrary code with root privilegesby connecting to the debugger over TCP.
This vulnerability affects Cisco Prime DCNM versions 10.1(1) and 10.1(2) for Windows, Linux, and virtual environments.
The second Prime DCNM vulnerability (CVE-2017-6640) arises due to a default user account that is protected by a static password. An attacker who can remotely log in to the affected system can use this account to gain privileged access to the server's management interface.
Both vulnerabilities in Prime DCNM were disclosed to Cisco by Commonwealth Bank of Australia researcher Antonius Mulder, and there is no evidence that they have been exploited by attackers to date. The flaws have been fixed in the new 10.2(1) release for Windows, Linux, and virtualization platforms.
Cisco also issued an advisory for a privilege escalation vulnerability that affects versions of the AnyConnect Secure Mobility Client for Windows earlier than version 4.4.02034. The vulnerability allows a local attacker to install and execute a file with SYSTEM privileges.
Another denial-of-service (DoS) vulnerability has been identified in the Session Initiation Protocol (SIP) of Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE). A remote, unidentified attacker could exploit this flaw to cause a DoS attack by flooding a vulnerable device with SIP INVITE packets.
The vulnerability, reported to Cisco by F-Secure's Knud Hojgaard, affects several TelePresence MX, Profile, SX, System Profile MXP, System EX, and Integrator C products. Two Collaboration Desk Endpoint DX series devices are also affected.
