Cisco Family March 2024 First Round Security Update Advisory
Overview
Cisco(https://www.cisco.com) has released a security update that fixes vulnerabilities in products it has been made. users of affected systems are advised to update to the latest version.
Affected Products
Cisco AppDynamics
Cisco Duo
Cisco Secure Client
Cisco Small Business
Cisco FXOS software
Cisco NX-OS software
Resolved Vulnerabilities
Vulnerability in Cisco Secure Client due to lack of validation of user input, allowing arbitrary script command execution (CVE-2024-20337) [1]
Vulnerability in Cisco Secure Client that could allow arbitrary code execution due to uncontrolled use of search path elements (CVE-2024-20338) [2]
Vulnerability in Cisco AppDynamics due to insufficient validation of user input, allowing access to sensitive data on affected devices (CVE-2024-20345) [3]
Vulnerability in Cisco Duo to invalidate locally created trusted sessions after rebooting an affected device, resulting in access to an affected device without valid privileges (CVE-2024-2030) [4]
Vulnerability in Cisco AppDynamics due to insufficient validation of user input, which could allow arbitrary script command execution (CVE-2024-20346) [5]
Authentication bypass vulnerability in Cisco Duo Authentication for Windows Logon and RDP due to failure to invalidate a locally created trusted session after a device reboot (CVE-2024-20301) [6]
Information disclosure vulnerability in Cisco Duo Authentication for Windows Logon and RDP due to improper storage of unencrypted registry keys in certain logs (CVE-2024-20292) [7]
AP Command Injection Vulnerability in the Cisco Small Business 100, 300, and 500 Series (CVE-2024-20335) [8]
Cisco Small Business 100, 300, and 500 Series Wireless AP Buffer Overflow Vulnerability (CVE-2024-20336) [8]
XSS Vulnerability in Cisco AppDynamics Controller (CVE-2024-20346) [9]
Denial of Service Vulnerability in the LLDP Feature in Cisco FXOS and NX-OS software (CVE-2024-20294) [10]
ISE Posture Module Privilege Escalation Vulnerability in Cisco Secure Client for Linux (CVE-2024-20338) [11]
CRLF injection vulnerability due to insufficient validation in the SAML authentication process in Cisco Secure Client (CVE-2024-20337) [12]
Vulnerability Patches
product-specific Vulnerability Patches were made available in the 03/06/2024 update. please refer to the ‘Affected Products’ and ‘Fixed Software’ in the product-specific information in the Referenced Sites below to apply the patches.
Referenced Sites
[1] Cisco Secure Client Carriage Return Line Feed Injection Vulnerability
[2] Cisco Secure Client for Linux with ISE Posture Module Privilege Escalation Vulnerability
[3] Cisco AppDynamics Controller Path Traversal Vulnerability
[4] Cisco Duo Authentication for Windows Logon and RDP Authentication Bypass Vulnerability
[5] Cisco AppDynamics Controller Cross-Site Scripting Vulnerability
[6] Cisco Duo Authentication for Windows Logon and RDP Authentication Bypass Vulnerability
[7] Cisco Duo Authentication for Windows Logon and RDP Information Disclosure Vulnerability
[8] Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection and Buffer Overflow Vulnerabilities
[9] Cisco AppDynamics Controller Cross-Site Scripting Vulnerability
[10] Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability
[11] Cisco Secure Client for Linux with ISE Posture Module Privilege Escalation Vulnerability
[12] Cisco Secure Client Carriage Return Line Feed Injection Vulnerability