Security Advisory

Cisco Product Security Update Advisories (CVE-2024-20290, CVE-2024-20252, CVE-2024-20254, CVE-2024-20255, CVE-2024-20272, CVE-2022-20716)

  • Feb 15 2024

Overview

 

An update has been made available to address vulnerabilities in Cisco products. users of affected versions are encouraged to update to the latest version.

 

Affected Products

 

CVE-2024-20290

  • Secure Endpoint Connector for Windows
  • Secure Endpoint Private Cloud

 

CVE-2024-20252

  • Cisco Expressway Series(when the Cluster Database (CDB) API feature is enabled)

 

CVE-2024-20254, CVE-2024-20255

  • Cisco Expressway Series

 

CVE-2024-20272

  • Cisco Unity Connection

 

CVE-2022-20716

  • SD-WAN vBond Orchestrator Software
  • SD-WAN vEdge Cloud Routers
  • SD-WAN vEdge Routers
  • SD-WAN vManage Software
  • SD-WAN vSmart Controller Software

 

Resolved Vulnerabilities

 

ClamAV OLE2 File Format Parsing Denial of Service Vulnerability(CVE-2024-20290)

CSRF Vulnerabilities in Cisco Expressway Series (CVE-2024-20252, CVE-2024-20254, CVE-2024-20255)

Unauthenticated Arbitrary File Upload Vulnerability in Cisco Unity Connection (CVE-2024-20272)

Improper Access Control Vulnerability in Cisco SD-WAN Software (CVE-2022-20716)

 

Vulnerability Patches

 

Vulnerability Patches have been made available through updates. please follow the instructions on the reference site to update to the latest vulnerability patch version.

CVE-2024-20290

  • Secure Endpoint Connector for Windows 7.5.17, 8.2.3.30119 versions
  • Secure Endpoint Private Cloud with updated connectors 3.8.0 version

 

CVE-2024-20252, CVE-2024-20254, CVE-2024-20255

  • 14.3.4, 15.0.0 version

 

CVE-2024-20272

  • versions of ciscocm.cuc.CSCwh14380_C0208-1.cop.sha512, ciscocm.cuc.CSCwh14380_C0208-1.cop.sha512 (version 15 is not vulnerable)

 

CVE-2022-20716

  • 20.3.6, 20.6.1, 20.7.1 versions

 

Reference Sites

 

[1] Cisco Security Advisories
https://sec.cloudapps.cisco.com/security/center/publicationListing.x
[2] ClamAV OLE2 File Format Parsing Denial of Service Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t
[3] Cisco Expressway Series Cross-Site Request Forgery Vulnerabilities
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3
[4] Cisco Unity Connection Unauthenticated Arbitrary File Upload Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuc-unauth-afu-FROYsCsD
[5] Cisco SD-WAN Solution Improper Access Control Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-file-access-VW36d28P

Tags:

Previous Post

Next Post