1. 主頁
  2. 保安警報
  3. 保安警報 (A23-01-06)

高危保安警報 (A23-01-06): Cisco 產品多個漏洞


 

發布日期: 2023年 1月 12日

  
  

描述:

Cisco 發布了安全公告，以應對 Cisco 裝置及軟件中的多個漏洞。有關漏洞及攻擊向量的資料，請參閱供應商網站的相應安全公告。

報告指針對 Cisco 已結束支援的 Small Business Routers 漏洞 (CVE-2023-20025 及 CVE-2023-20026) 的概念驗證 (PoC) 程式碼已被公開。因受影響的路由器已結束支援，修補程式仍未可獲取，但Cisco 已提供了緩解措施。系統管理員應安排更換已結束支援的產品至受供應商支援的產品型號或轉至其他受支援的技術。

 

受影響的系統:

  • Cisco BroadWorks Application Delivery Platform
  • Cisco BroadWorks Application Server
  • Cisco BroadWorks Xtended Services Platform
  • Cisco CX Cloud Agent
  • Cisco Industrial Network Director
  • Cisco IP Phone 7800 and 8800 Series Web Management Interface
  • Cisco Network Services Orchestrator
  • Cisco RoomOS Software
  • Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers
  • Cisco Small Business RV016, RV042, RV042G, and RV082 Routers
  • Cisco Small Business RV160 and RV260 Series VPN Routers
  • Cisco TelePresence Collaboration Endpoint Software
  • Cisco Unified Intelligence Center
  • Cisco Webex Room Phone
  • Cisco Webex Share

有關受影響產品的詳細資料，請參閱供應商網站的相應安全公告中有關 “Affected Products” 的部分。

 

影響:

成功利用漏洞可以在受影響的系統導致遠端執行程式碼、跨網址程式編程、服務被拒絕、泄漏資訊、權限提升、繞過保安限制、仿冒詐騙或篡改，視乎攻擊者利用哪些漏洞而定。

 

建議:

受影響系統的系統管理員應遵從產品供應商的建議，立即採取行動以降低風險。有關修補程式的詳細資料，請參閱供應商網站的相應安全公告中有關 “Fixed Software”的部分。

系統管理員可聯絡其產品支援供應商，以取得修補程式及有關支援。

 

進一步資訊:

  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-dos-HpkeYzp
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-xss-EzqDXqG4
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-xss-Omm8jyBX
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cxagent-gOq9QjqZ
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-fZyVjJtG
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lldp-memlk-McOecPT
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-zjBeMkZg
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-dkjGFgRK
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-cmd-exe-n47kJQLE
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-rcedos-7HjP74jD
  • https://www.hkcert.org/tc/security-bulletin/cisco-end-of-life-small-business-routers-multiple-vulnerabilities_20230112
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20002
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20007 (to CVE-2023-20008)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20018 (to CVE-2023-20020)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20025 (to CVE-2023-20026)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20037 (to CVE-2023-20038)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20040
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20043 (to CVE-2023-20045)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20047
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20058


標籤 : Cisco , Cisco BroadWorks Application Delivery Platform , Cisco BroadWorks Application Server , Cisco BroadWorks Xtended Services Platform , Cisco CX Cloud Agent , Cisco Industrial Network Director , Cisco IP Phone , Cisco NSO , Cisco RoomOS , Cisco Router , Cisco TelePresence Collaboration Endpoint , Cisco Unified Intelligence Center , Cisco Webex
標籤