Cisco and Fortinet Release Security Patches for Multiple Products

Cisco on Wednesday rolled out patches for 10 security flaws^[1]
spanning multiple products, one of which is rated Critical in
severity and could be weaponized to conduct absolute path traversal
attacks.

The issues, tracked as CVE-2022-20812 and
CVE-2022-20813, affect Cisco Expressway Series and Cisco
TelePresence Video Communication Server (VCS) and “could allow a
remote attacker to overwrite arbitrary files or conduct null byte
poisoning attacks on an affected device,” the company said^[2]
in an advisory.

CVE-2022-20812 (CVSS score: 9.0), which concerns a case of
arbitrary file overwrite in the cluster database API, requires the
authenticated, remote attacker to have Administrator read-write
privileges on the application so as to be able to mount path
traversal attacks as a root user.

“This vulnerability is due to insufficient input validation of
user-supplied command arguments,” the company said. “An attacker
could exploit this vulnerability by authenticating to the system as
an administrative read-write user and submitting crafted input to
the affected command.”

Successful exploitation of the flaw could enable the adversary
to overwrite arbitrary files on the underlying operating
system.

CVE-2022-20813 (CVSS score: 7.4), on the other hand, has been
described as a null byte poisoning flaw arising due to improper
certificate validation, which could be weaponized by an attacker to
stage a man-in-the-middle (MitM) attack and gain unauthorized
access to sensitive data.

Also patched by Cisco is a high-severity flaw in its Smart
Software Manager On-Prem (CVE-2022-20808^[3], CVSS score: 7.7) that
could be abused by an authenticated, remote attacker to cause a
denial of service (DoS) condition on an affected device.

Fortinet issues fixes for several products

In a related development, Fortinet addressed multiple
high-severity vulnerabilities affecting FortiAnalyzer, FortiClient,
FortiDeceptor, and FortiNAC –

• CVE-2021-43072^[4] (CVSS score: 7.4) –
  Stack-based buffer overflow via crafted CLI execute command in
  FortiAnalyzer, FortiManager, FortiOS and FortiProxy
• CVE-2021-41031^[5] (CVSS score: 7.8) –
  Privilege Escalation via directory traversal attack in FortiClient
  for Windows
• CVE-2022-30302^[6] (CVSS score: 7.9) –
  Multiple path traversal vulnerabilities in FortiDeceptor management
  interface, and
• CVE-2022-26117^[7] (CVSS score: 8.0) –
  Unprotected MySQL root account in FortiNAC

Should the flaws be successfully exploited, it may allow an
authenticated attacker to execute arbitrary code, retrieve and
delete files, and access MySQL databases, or even permit a local
unprivileged actor to escalate to SYSTEM permissions.