Cisco issues free software updates to fix weaknesses in its Enterprise NFV Infrastructure Software. Multiple vulnerabilities have been discovered in Cisco’s Enterprise NFV Infrastructure Software (NFVIS). The worst of the vulnerabilities could let an attacker escape from the guest virtual machine (VM) to the host machine, Cisco disclosed. The other two problems involve letting a bad actor inject commands that execute at the root level and allowing a remote attacker to leak system data from the host to the VM. NFVIS is Linux-based infrastructure software designed to help enterprises and service providers to deploy virtualized network functions, such as a virtual router, firewall and WAN acceleration, Cisco stated. The critical vulnerability – with a CVSS score of 9.9 out of 10 – could allow an attacker to send an API call from a VM that will execute with root-level privileges on the NFVIS host. A successful exploit could allow the attacker to completely compromise an NFVIS host. Cisco said the vulnerability is due to insufficient guest restrictions. Another exposure in the image registration process of NFVIS could let an unauthenticated, remote attacker inject commands that could then execute at the root level on the NFVIS host during the image registration process. The weakness could convince an administrator on the host machine to install a VM image with crafted metadata that will execute commands with root–level privileges during the VM registration process, Cisco stated. A successful exploit could allow the attacker to inject commands with root-level privileges into the NFVIS host. This vulnerability is due to improper input validation, Cisco stated. The third NFVIS advisory relates to the import function of the software that could let an unauthenticated, remote attacker leak system data from the host to any configured VM. An attacker could exploit this vulnerability by persuading an administrator to import a crafted file that will read data from the host and write it to any configured VM. A successful exploit could allow the attacker to access system information from the host, such as files containing user data, on any configured VM, Cisco stated. An attacker who already has authenticated access on a VM that is configured within the NFVIS host could obtain direct access to confidential system information, Cisco stated. This vulnerability is due to the resolution of external entities in the XML parser, Cisco added. Cisco has issued free software updates that address these vulnerabilities and said there are no workarounds. Related content news analysis Red Hat unveils image mode for its Linux distro New container image deployment method for Red Hat Enterprise Linux is aimed at helping enterprises streamline operations and management. By Maria Korolov May 09, 2024 5 mins Linux Networking news Insecure protocols leave networks vulnerable: report The Cato CTRL SASE Threat Report reveals the trusted traffic networks must stop, as many enterprises still rely on the use of insecure protocols such as HTTP, Telnet and early versions of SMB. By Denise Dubie May 09, 2024 4 mins SASE Network Security Networking feature What is a digital twin and why is it important to IoT? Digital twins are virtual replicas of physical devices that IT pros and data scientists can use to run simulations before actual devices are built and deployed. Digital twins can also take real-time IoT data and apply AI and data analytics to optimiz By Josh Fruhlinger and Keith Shaw May 09, 2024 17 mins Internet of Things Network Security Networking news 2024 global network outage report and internet health check ThousandEyes tracks internet and cloud traffic and provides Network World with weekly updates on the performance of ISPs, cloud service providers, and UCaaS providers. By Ann Bednarz May 08, 2024 43 mins Internet Service Providers Network Management Software Cloud Computing PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe