Sistemas Afectados

• cisco — dna_spaces
• cisco — evolved_programmable_network_manager
• cisco — modeling_labs
• cisco — wap125_firmware Cisco Small Business en versiones 100, 300, y 500

Descripción

CISCO ha hecho publico varias vulnerabilidades sobre varios de sus productos donde acentúan la posibilidad de un usuario autenticado elevar privilegios y la ejecución de código arbitrario dada una débil restricción, inyección de código por múltiples factores entre la que incluye entrada no sanitizada.

Referencia

• https://tools.cisco.com/security/center/publicationListing.x
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-prvesc-q6T6BzW
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnasp-conn-cmdinj-HOj4YV5n
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-cmd-inj-YU5e6tB3
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cml-cmd-inject-N4VYeQXB
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-Mp9FSdG
• CVE-2021-1487
• CVE-2021-1531
• CVE-2021-1547
• CVE-2021-1548
• CVE-2021-1549
• CVE-2021-1550
• CVE-2021-1551
• CVE-2021-1552
• CVE-2021-1553
• CVE-2021-1554
• CVE-2021-1555
• CVE-2021-1557
• CVE-2021-1558
• CVE-2021-1559
• CVE-2021-1560

Solución

Cisco recomienda mantener actualizado sus productos con las últimas versiones [De acuerdo con cada sistema antes mencionado].

• Cisco DNA Spaces Connector releases 2.3.1
• Cisco DNA Spaces: Connector docker software releases 2.0.519
• Cisco Prime Infrastructure releases 3.9
• Cisco EPN Manager releases 5.1
• Cisco Modeling Lab releases 2.2.1
• WAP125 Wireless-AC Dual Band Desktop Access Point with PoE 1.0.4.3
• WAP150 Wireless-AC/N Dual Radio Access Point with PoE 1.1.3.2
• WAP361 Wireless-AC/N Dual Radio Wall Plate Access Point with PoE 1.1.3.2
• WAP581 Wireless-AC Dual Radio Wave 2 Access Point with 2.5GbE LAN 1.0.4.4