A Cisco Small Business switch has revealed 4 vulnerabilities that allow a remote attacker to gain full access to the device with root privileges without authentication. To exploit these issues, the attacker must be able to send requests to the network port that supports the web interface. These issues have been assigned a critical danger level (9.8 out of 10). There are reports of a prototype working exploit.
The identified vulnerabilities (CVE-2023-20159, CVE-2023-20160, CVE-2023-20161, CVE-2023-20189) are caused by memory handling errors in various handlers available before authentication. The vulnerabilities lead to buffer overflows when processing specially crafted external data. Additionally, four less critical vulnerabilities (CVE-2023-20024, CVE-2023-20156, CVE-2023-20157, CVE-2023-20158) have been found in the Cisco Small Business series, allowing remote denial of service initiation, and one vulnerability (CVE-2023-20162) allows access to device configuration information without authentication.
The vulnerabilities affect the Smart Switch series 250, 350, 350X, 550X, Business 250, and Business 350, as well as the Small Business series 200, 300, and 500. The vulnerability does not manifest in the 220 and Business 220 switch series. Problems have been fixed in firmware updates 2.5.9.16 and 3.3.0.16. Firmware updates will not be created for the Small Business 200, 300, and 500 series as the lifecycle of these models has already ended.
Forrás: opennet.ru
