Cisco Family July 2024 First Round Security Update Advisory
Overview
Cisco(https://www.cisco.com) has released a security update that fixes vulnerabilities in products it has been made. Users of affected systems are advised to update to the latest version.
Affected Products
Cisco Identity Services Engine Software
Cisco Secure Email
Cisco Secure Web Appliance
Cisco Small Business RV Series Router Firmware
Cisco Smart Software Manager On-Prem
Cisco TelePresence Video Communication Server (VCS) Expressway
Cisco Intelligent Node Software
Resolved Vulnerabilities
Vulnerability in Cisco Secure Email due to lack of data validation, which could lead to the replacement of all files in the default file system (CVE-2024-20401, CVSS 9.8) [1]
Vulnerability in Cisco Secure Web Appliance due to lack of validation of user input, allowing elevation of privilege to administrator level (CVE-2024-20435, CVSS 8.8) [2]
Vulnerability in Cisco Small Business RV Series Router Firmware due to lack of data validation, which could allow arbitrary code execution with administrator privileges (CVE-2024-20416, CVSS 6.5) [3]
Vulnerability in Cisco Secure Email due to lack of input validation, allowing arbitrary command execution (CVE-2024-20429, CVSS 6.5) [4]
Vulnerability in Cisco Identity Services Engine Software due to improper validation of files uploaded to the web-based management interface, allowing malicious files to be stored on the system (CVE-2024-20296, CVSS 4.7) [5]
Vulnerability in Cisco TelePresence Video Communication Server (VCS) Expressway that redirects a user to a malicious web page due to insufficient validation of input values (CVE-2024-20400, CVSS 4.7) [6]
Vulnerability in Cisco Smart Software Manager On-Prem due to insufficient data handling, allowing access to the web UI or API with the privileges of a compromised user (CVE-2024-20419, CVSS 10.0) [7]
Vulnerability in Cisco Intelligent Node Software that could allow an unauthenticated, remote attacker to hijack TLS connections between Cisco iNode Manager and associated intelligent nodes and send arbitrary traffic to the affected device (CVE-2024-20323, CVSS 7.5) [8]
Vulnerability Patches
Product-specific Vulnerability Patches were made available in the 07/17/2024 update. Please refer to the ‘Affected Products’ and ‘Fixed Software’ in the product-specific information in the Referenced Sites below to apply the patches.
Referenced Sites
[1] Cisco Secure Email Gateway Arbitrary File Write Vulnerability
[2] Cisco Secure Web Appliance Privilege Escalation Vulnerability
[3] Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers Authenticated Remote Code Execution Vulnerability
[4] Cisco Secure Email Gateway Server-Side Template Injection Vulnerability
[5] Cisco Identity Services Engine Arbitrary File Upload Vulnerability
[6] Cisco Expressway Series Open Redirect Vulnerability
[7] Cisco Smart Software Manager On-Prem Password Change Vulnerability
[8] Cisco Intelligent Node Software Static Key Vulnerability