1. 主页
  2. 保安警报
  3. 保安警报 (A23-01-06)

高危保安警报 (A23-01-06): Cisco 产品多个漏洞


 

发布日期: 2023年 1月 12日

  
  

描述:

Cisco 发布了安全公告，以应对 Cisco 装置及软件中的多个漏洞。有关漏洞及攻击向量的资料，请参阅供应商网站的相应安全公告。

报告指针对 Cisco 已结束支援的 Small Business Routers 漏洞 (CVE-2023-20025 及 CVE-2023-20026) 的概念验证 (PoC) 程式码已被公开。因受影响的路由器已结束支援，修补程式仍未可获取，但Cisco 已提供了缓解措施。系统管理员应安排更换已结束支援的产品至受供应商支援的产品型号或转至其他受支援的技术。

 

受影响的系统:

  • Cisco BroadWorks Application Delivery Platform
  • Cisco BroadWorks Application Server
  • Cisco BroadWorks Xtended Services Platform
  • Cisco CX Cloud Agent
  • Cisco Industrial Network Director
  • Cisco IP Phone 7800 and 8800 Series Web Management Interface
  • Cisco Network Services Orchestrator
  • Cisco RoomOS Software
  • Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers
  • Cisco Small Business RV016, RV042, RV042G, and RV082 Routers
  • Cisco Small Business RV160 and RV260 Series VPN Routers
  • Cisco TelePresence Collaboration Endpoint Software
  • Cisco Unified Intelligence Center
  • Cisco Webex Room Phone
  • Cisco Webex Share

有关受影响产品的详细资料，请参阅供应商网站的相应安全公告中有关 “Affected Products” 的部分。

 

影响:

成功利用漏洞可以在受影响的系统导致远端执行程式码、跨网址程式编程、服务被拒绝、泄漏资讯、权限提升、绕过保安限制、仿冒诈骗或篡改，视乎攻击者利用哪些漏洞而定。

 

建议:

受影响系统的系统管理员应遵从产品供应商的建议，立即採取行动以降低风险。有关修补程式的详细资料，请参阅供应商网站的相应安全公告中有关 “Fixed Software”的部分。

系统管理员可联络其产品支援供应商，以取得修补程式及有关支援。

 

进一步资讯:

  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-dos-HpkeYzp
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-xss-EzqDXqG4
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-xss-Omm8jyBX
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cxagent-gOq9QjqZ
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-fZyVjJtG
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lldp-memlk-McOecPT
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-zjBeMkZg
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-dkjGFgRK
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-cmd-exe-n47kJQLE
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-rcedos-7HjP74jD
  • https://www.hkcert.org/tc/security-bulletin/cisco-end-of-life-small-business-routers-multiple-vulnerabilities_20230112
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20002
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20007 (to CVE-2023-20008)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20018 (to CVE-2023-20020)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20025 (to CVE-2023-20026)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20037 (to CVE-2023-20038)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20040
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20043 (to CVE-2023-20045)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20047
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20058


标签 : Cisco , Cisco BroadWorks Application Delivery Platform , Cisco BroadWorks Application Server , Cisco BroadWorks Xtended Services Platform , Cisco CX Cloud Agent , Cisco Industrial Network Director , Cisco IP Phone , Cisco NSO , Cisco RoomOS , Cisco Router , Cisco TelePresence Collaboration Endpoint , Cisco Unified Intelligence Center , Cisco Webex
标签