Cisco patches weaknesses in wireless, SD-WAN and IOS XE configuration software. Credit: JanBaby / Pixabay Cisco has patched three critical security holes in its IOS XE software that’s used across a variety of its core routers and switches. The three critical warnings are part of a big release of 32 security alerts, many of which are IOS XE-related, including firewall, SD-WAN and wireless access vulnerabilities. Of the critical patches, the worst is a weakness in the Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers; it’s rated as a 10 out of 10 on the Common Vulnerability Scoring System (CVSS). The vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. An attacker could exploit this vulnerability by sending a crafted CAPWAP packet to an affected device. CAPWAP is a networking protocol that lets users centrally manage wireless access points. A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the affected device to crash and reload, resulting in a DoS, Cisco stated. The second critical warning – with a 9.8 CVSS rating – impacts Cisco IOS XE SD-WAN Software and could let an attacker set off a buffer overflow on a the SD-WAN device, Cisco said. “This vulnerability is due to insufficient bounds checking when an affected device processes traffic,” Cisco stated. “An attacker could exploit this vulnerability by sending crafted traffic to the device. A successful exploit could allow the attacker to cause a buffer overflow and possibly execute arbitrary commands with root-level privileges, or cause the device to reload, which could result in a DOS condition.” The third critical warning also has a 9.8 CVSS rating and involves a weakness in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software that could let an attacker install, manipulate, or delete the configuration of an affected device and cause memory corruption that results in a DoS. The vulnerability lets an attacker bypass NETCONF or RESTCONF authentication. “A successful exploit could allow the attacker to use NETCONF or RESTCONF to install, manipulate, or delete the configuration of a network device or to corrupt memory on the device, resulting a DoS,” Cisco stated. Cisco said there is a workaround that addresses this vulnerability: Remove the enable password and configure an enable secret. There is also a mitigation that addresses this vulnerability: To limit the attack surface of this vulnerability, ensure that access control lists are in place for NETCONF and RESTCONF to prevent attempted access from untrusted subnets. Cisco has released free software updates that address the critical vulnerabilities. Related content news Singapore government pushes energy-efficient data center plan The city state is looking at greener energy sources and wants to make every aspect of data center energy consumption, from cooling to coding, more efficient. By John Leyden May 31, 2024 4 mins Energy Efficiency Data Center Design Data Center Management news Everyone but Nvidia joins forces for new AI interconnect Hyperscalers and chip makers, including AMD, Broadcom, Cisco, Google, HPE, Intel and Microsoft, are partnering to develop a high-speed chip interconnect to rival Nvidia’s NVLink technology. By Andy Patrizio May 30, 2024 4 mins CPUs and Processors Data Center news AT&T taps Cisco fixed 5G wireless gateways for WAN service Cisco Meraki devices are also part of fixed 5G wireless services from T-Mobile and Verizon. By Michael Cooney May 30, 2024 3 mins 5G Wireless Security WAN news Alibaba Cloud is betting on emerging markets with massive price cuts The strategy to lower prices may not only help Alibaba undercut competition from larger hyperscalers in emerging markets but also have a more positive effect on its image as a Chinese provider, experts say. By Anirban Ghoshal May 30, 2024 6 mins Cloud Computing PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe