Cisco today released security updates to address critical remote code execution (RCE), authentication bypass, and default credentials vulnerabilities affecting many routers and firewall devices that could lead to complete device takeover.
Cisco also issued a security update to fix a escalation in Cisco Prime License Manager software.
The five security flaws patched today received CVSS qualitative severity scores of 9.8 from Cisco, which makes them all critical vulnerabilities.
Remote exploitation by unauthorized attackers
They can also be exploited remotely by unauthorized attackers as part of low -sophistication that do not require user interaction.
A complete list of all critical security issues currently facing Cisco is available below, along with links to their corresponding security .
“The Cisco Product Security Incident Response Team (PSIRT) has not identified any malicious use of the vulnerability described in this advisory,” the company states in all five advisories.
The vulnerabilities were reported to Cisco by the following external security researchers: Larryxi of XDSEC, Gyengtak Kim, Jeongun Baek and Sanghyuk Lee of GeekPwn, Quentin Kaiser and Adam Engle of AdventHealth.
Cisco also published 22 high- and medium-severity security vulnerabilities affecting multiple router models and Cisco SD-WAN Solution software versions.
