Cisco Family October 2024 Secondary Security Update Advisory
Overview
Cisco (https://www.cisco.com) has released a security update that fixes vulnerabilities in products it has been made. Users of affected systems are advised to update to the latest version.
Affected Products
Cisco Small Business RV Series Routers
Cisco Nexus Dashboard Fabric Controller (NDFC)
Cisco Nexus Dashboard Orchestrator (NDO)
Cisco Nexus Dashboard Insights
Cisco Meraki MX Firmware
Resolved Vulnerabilities
The web-based management interface in Cisco Small Business RV Series Router Firmware is vulnerable to elevate privileges from guest to administrator due to sensitive information (CVE-2024-20470, CVSS 7.2)
Logging feature vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) that could allow an attacker with access to technical support files to view sensitive information (CVE-2024-20490, CVSS 8.6)
Logging functionality vulnerability in Cisco Nexus Dashboard Insights that could allow an attacker with access to the technical support file to view sensitive information (CVE-2024-20491, CVSS 8.6)
Vulnerabilities in Cisco AnyConnect VPN on Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices that could allow an unauthenticated remote attacker to cause a DoS condition in the AnyConnect service on the affected device (CVE-2024-20500, CVE-2024-20502, CVSS 7.5)
Vulnerabilities in the web-based management interface on Cisco Small Business RV042, RV042G, RV320, and RV325 routers that allow an authenticated, administrator-level remote attacker to execute arbitrary code as the root user (CVE-2024-20518, CVE-2024-20519, CVE-2024-20520, CVE-2024-20521, CVSS 9.1)
Vulnerability Patches
Product-specific Vulnerability Patches were made available in the October 02, 2024 update. Please refer to the ‘Affected Products’ and ‘Fixed Software’ in the product-specific information in the Referenced Sites below to apply the patches.
Referenced Sites
[1] Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Privilege Escalation and Remote Command Execution Vulnerabilities
[2] Cisco Nexus Dashboard Hosted Services Information Disclosure Vulnerabilities
[3] Cisco Meraki MX and Z Series Teleworker Gateway AnyConnect VPN Denial of Service Vulnerabilities
[4] Cisco Small Business RV042, RV042G, RV320, and RV325 Routers Denial of Service and Remote Code Execution Vulnerabilities