Critical Patches Issued for Cisco Expressway Series, TelePresence VCS Products

Cisco this week shipped patches to address a new round of
critical security vulnerabilities affecting Expressway Series and
Cisco TelePresence Video Communication Server (VCS) that could be
exploited by an attacker to gain elevated privileges and execute
arbitrary code.

The two flaws – tracked as CVE-2022-20754 and CVE-2022-20755^[1] (CVSS scores: 9.0) –
relate to an arbitrary file write and a command injection flaw in
the API and web-based management interfaces of the two products
that could have serious impacts on affected systems.

The company said both the issues stem from insufficient input
validation of user-supplied command arguments, a weakness that
could be weaponized by an authenticated, remote attacker to carry
out directory traversal attacks, overwrite arbitrary files, and run
malicious code on the underlying operating system as the root
user.

“These vulnerabilities were found during internal security
testing by Jason Crowder of the Cisco Advanced Security Initiatives
Group (ASIG),” the company noted in its advisory published
Wednesday.

Also addressed by Cisco are three other flaws in StarOS, Cisco
Identity Services Engine RADIUS Service, and Cisco Ultra Cloud Core
– Subscriber Microservices Infrastructure software –

• CVE-2022-20665^[2] (CVSS score: 6.0) – A
  command injection vulnerability in Cisco StarOS that could allow an
  allow an attacker with administrative credentials to execute
  arbitrary code with root privileges
• CVE-2022-20756^[3] (CVSS score: 8.6) – A
  denial-of-service (DoS) vulnerability affecting the RADIUS feature^[4]
  of Cisco Identity Services Engine (ISE)
• CVE-2022-20762^[5] (CVSS score: 7.8) – A
  privilege escalation flaw in the Common Execution Environment (CEE)
  ConfD CLI of Cisco Ultra Cloud Core – Subscriber Microservices
  Infrastructure (SMI) software that could permit an authenticated,
  local attacker to escalate to root privileges

Cisco also noted that it found no evidence of malicious
exploitation of the vulnerabilities, adding they were either found
during internal security testing or during the resolution of a
Cisco Technical Assistance Center (TAC) support case.

But nevertheless, customers are urged to update to the latest
versions as soon as possible to mitigate any potential in-the-wild
attacks.