Cisco patched two critical security flaws in its Data Center Network Manager software that could allow attackers to take over affected devices. The vendor says it’s “not aware of any malicious use” of either of the two vulnerabilities.
Cisco’s Data Center Network Manager (DCNM) is the network management platform for all of its network operating system-enable deployments including Cisco Nexus switches. Threat researchers found the two critical bugs in the web-based management interface of the DCNM software. Cisco said there are no workarounds for either, but on Wednesday it released free software updates that it says will fix both critical flaws.
One of the bugs allows hackers to send a crafted HTTP request to the affected device, which allows them to gain administrative access and then execute arbitrary actions on the device.
The other vulnerability allows attackers to upload specially crafted data to the affected device. They could then write files and execute code with root privileges on the device.
The vendor also reported two additional vulnerabilities in the DCNM software on Wednesday. It deemed one high impact and the other medium and released patches to fix both. Cisco said it isn’t aware of either of these vulnerabilities being used in the wild.
The latest security flaws follow a particularly buggy May that included Thrangrycat, a vulnerability found in “tens of millions” of Cisco enterprise routers, switches, and firewalls that could allow hackers to remotely attack corporate networks, steal data, and attack other devices connected to the networks. And May 1 held the dubious distinction of Cisco issuing the highest number of security advisories (41) in a single day for at least a year.
Comments