Cisco has released security advisories addressing a total of seven vulnerabilities, including two critical-rated issues in its Expressway and TelePresence products. The first vulnerability, identified as CVE-2023-20105, enables remote administrators to escalate their privilege level from read-only to read-write by exploiting a flaw in password change requests. This could potentially allow attackers to modify passwords, including those of administrative read-write users, and impersonate them. The second vulnerability, CVE-2023-20192, affects privilege management in both Expressway and TelePresence VCS, allowing attackers to elevate their command line interface privileges from read-only to read-write. Successful exploitation of this bug could enable unauthorized execution of commands, including the modification of system configuration parameters.
Cisco has provided a workaround for CVE-2023-20192, advising administrators to disable access for users with read-only privileges. Additionally, the company’s latest advisories address three high-rated vulnerabilities in Adaptive Security Appliance Software and Firepower Threat Defense Software, Unified Communications Manager IM and Presence Service, as well as the AnyConnect client for Windows and Secure Client for Windows. Furthermore, medium-rated vulnerabilities in Small Business 200, 300, and 500 products, Secure Workload, and UCM have also been patched as part of today’s release.
