保安警报 (A23-04-01): Cisco 产品多个漏洞

描述:

Cisco 发布了安全公告，以应对 Cisco 装置及软件中的多个漏洞。有关漏洞及攻击向量的资料，请参阅供应商网站的相应安全公告。

受影响的系统:

• Cisco Duo Authentication
• Cisco Evolved Programmable Network Manager
• Cisco Identity Services Engine
• Cisco Packet Data Network Gateway
• Cisco Prime Infrastructure
• Cisco Secure Network Analytics
• Cisco Small Business RV016、RV042、RV042G、RV082、RV320 及 RV325 路由器
• Cisco Unified Contact Center Express

受影响的路由器 Cisco Small Business Routers devices 已结束支援，修补程式仍未可获取，但 Cisco 已提供了临时解决方法。系统管理员应安排更换已结束支援的产品至受供应商支援的产品型号或转至其他受支援的技术。

有关受影响产品的详细资料，请参阅供应商网站的相应安全公告中有关 “Affected Products” 的部分。

影响:

成功利用漏洞可以在受影响的系统导致远端执行程式码、插入任意指令码、服务被拒绝、泄漏资讯、权限提升、绕过保安限制或仿冒诈骗，视乎攻击者利用哪些漏洞而定。

建议:

受影响系统的系统管理员应遵从产品供应商的建议，立即採取行动以降低风险。有关修补程式的详细资料，请参阅供应商网站的相应安全公告中有关 “Fixed Software”的部分。

系统管理员可联络其产品支援供应商，以取得修补程式及有关支援。

进一步资讯:

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-adeos-MLAyEcvk
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pdng-dos-KmzwEy2Q
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-replay-knuNKd
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-2XbOg9Dg
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-eRPWAXLe
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-stored-xss-vqz7gC8W
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv01x_rv32x_rce-nzAGWWDD
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv32x-cmdinject-cKQsZpxL
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-stealth-rce-BDwXFK9C
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-stealthsmc-rce-sfNBPjcS
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uccx-xss-GO9L9xxr
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20051
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20096
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20102
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20103
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20117
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20121 (to CVE-2023-20124)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20127 (to CVE-2023-20131)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20137 (to CVE-2023-20153)