Cisco Issues Patches for 3 New Flaws Affecting Enterprise NFVIS Software

Cisco Systems on Wednesday shipped security patches to contain three flaws impacting its Enterprise NFV Infrastructure Software (NFVIS) that could permit an attacker to fully compromise and take control over the hosts.

Tracked as CVE-2022-20777, CVE-2022-20779, and CVE-2022-20780, the vulnerabilities "could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM," the company said.

Credited for discovering and reporting the issues are Cyrille Chatras, Pierre Denouel, and Loïc Restoux of Orange Group. Updates have been released in version 4.7.1.

The networking equipment company said the flaws affect Cisco Enterprise NFVIS in the default configuration. Details of the three bugs are as follows -

CVE-2022-20777 (CVSS score: 9.9) - An issue with insufficient guest restrictions that allows an authenticated, remote attacker to escape from the guest VM to gain unauthorized root-level access on the NFVIS host. CVE-2022-20779 (CVSS score: 8.8) - An improper input validation flaw that permits an unauthenticated, remote attacker to inject commands that execute at the root level on the NFVIS host during the image registration process. CVE-2022-20780 (CVSS score: 7.4) - A vulnerability in the import function of Cisco Enterprise NFVIS that could allow an unauthenticated, remote attacker to access system information from the host on any configured VM.

Also addressed by Cisco recently is a high-severity flaw in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15.

"This includes privilege level 15 access to the device using management tools like the Cisco Adaptive Security Device Manager (ASDM) or the Cisco Security Manager (CSM)," the company noted in an advisory for CVE-2022-20759 (CVSS score: 8.8).

Furthermore, Cisco last week issued a "field notice" urging users of Catalyst 2960X/2960XR appliances to upgrade their software to IOS Release 15.2(7)E4 or later to enable new security features designed to "verify the authenticity and integrity of our solutions" and prevent compromises.

Found this article interesting? Follow THN on Facebook, Twitter  and LinkedIn to read more exclusive content we post.