Two vulnerabilities have been disclosed in the Cisco’s Small Business Routers RV320 and RV325. CVE-2019-1652: Routers Command Injection Vulnerability A command injection vulnerability has been disclosed in Cisco Small Business routers RV320 and RV325 on firmware versions 1.4.2.15 through 1.4.2.19. CVE-2019-1652 has been assigned to track this vulnerability. An attacker can target this vulnerability by sending … Continue reading “Cisco Small Business Router Vulnerabilities”
Tag: Cisco
Cisco ASA and Cisco FTD Software Denial of Service Vulnerability: CVE-2018-15454
A vulnerability in handling of Session Initiation Protocol (SIP) traffic by Cisco devices has been disclosed. CVE-2018-15454 has been assigned to track this vulnerability. Cisco has released advisory cisco-sa-20181031-asaftd-sip-dos to address this issue, it ha rated this issue as a high priority. The vulnerability affects a range of Cisco products if SIP inspection is enabled. … Continue reading “Cisco ASA and Cisco FTD Software Denial of Service Vulnerability: CVE-2018-15454”
BLEEDINGBIT Vulnerability
Two critical vulnerabilities have been discovered in BLE (Bluetooth Low Energy) chips manufactured by Texas Instruments (TI). The vulnerabilities have been named BLEEDINGBIT. As this vulnerability affects the BLE chips, any device using said hardware is a potential target for exploitation. The following CVEs have been assigned to track BLEEDINGBIT vulnerability. BLEEDINGBIT RCE vulnerability (CVE-2018-16986) BLEEDINGBIT … Continue reading “BLEEDINGBIT Vulnerability”
Cisco Webex Update Service Command Injection Vulnerability : CVE-2018-15442
A command injection vulnerability has been disclosed in Cisco Webex. Upon successful exploitation an attacker can execute arbitrary commands on the target machine. The vulnerability has been assigned CVE-2018-15442. The vulnerability has been named ‘WebExec‘. Cisco has addressed this issue in cisco-sa-20181024-webex-injection. The issue affects All Cisco Webex Meetings Desktop App releases prior to 33.6.0. … Continue reading “Cisco Webex Update Service Command Injection Vulnerability : CVE-2018-15442”
Cisco ASA AnyConnect/WebVPN Double free Vulnerability : CVE-2018-0101
A double free vulnerability has been discovered in Cisco ASA devices in the SSL-VPN feature . The vulnerability has been assigned CVE-2018-0101. An attacker can exploit this vulnerability by sending custom crafted XML packets to the webvpn interface. Upon successful exploitation an attacker can achieve remote arbitrary code excution, reload the device or shutdown the … Continue reading “Cisco ASA AnyConnect/WebVPN Double free Vulnerability : CVE-2018-0101”
WebEx Arbitrary Remote Code Execution via GPC Sanitization bypass
Introduction: Cisco WebEx has millions of users who use it regularly for online meeting, web conferencing and videoconferencing. Recently a remote code execution vulnerability was discovered by Google Project Zero team, with ID – CVE-2017-6753. Similar to CVE-2017-3823, the vulnerability is described as “a design defect in the extension”. The vulnerability allows an attacker to … Continue reading “WebEx Arbitrary Remote Code Execution via GPC Sanitization bypass”