It’s Cisco patch day for Nexus Dashboard customers, with multiple critical vulnerabilities uncovered.
The Nexus Dashboard is a monitoring suite for data centre infrastructure, and Cisco has found one bug with a critical rating, three high-severity bugs, and four medium-severity bugs in the system.
This advisory details CVE-2022-20857, CVE-2022-20861, and CVE-2022-20858.
CVE-2022-20857, the critical vulnerability, is a flaw in an unspecified API, that gives an unauthenticated attacker remote code execution access over the data network, by sending crafted HTTP requests.
The advisory warns that “successful exploit could allow the attacker to execute arbitrary commands as the root user in any pod on a node”.
An exploit for CVE-2022-20861, a cross-site request forgery vulnerability, “may let the attacker to take activities with administrator capabilities on an affected device,” according to the rating system.
An authenticated administrator would need to click on a malicious link, and the attacker would need access to the management network.
The high severity CVE-2022-20858 vulnerability might give “an unauthenticated, remote attacker access to a service that is running in the data and management networks on an affected device,” according to the report.
Cisco found that a service that manages container images lacks adequate access restrictions, making it possible for an attacker to obtain malicious container images or upload them to a target device.
A third party in the middle could pretend to be the controllers, interfere with device communications, and read private data like administrator credentials.
The third warning describes three issues, CVE-2022-20906, CVE-2022-2090, and CVE-2022-20908, which are classed as medium severity due to the possibility of privilege escalation for a local, authenticated attacker.
According to the alert, “These vulnerabilities are attributable to poor input validation during CLI command execution on a vulnerable device.”
By logging in as the rescue-user and running vulnerable CLI commands with a malicious payload, an attacker might exploit these flaws.
Similar to CVE-2022-20913, which is classed as medium severity, CVE-2022-20913 is only exploitable by a local authenticated attacker who might write arbitrary files on an afflicted device.
Users of Nexus Dashboard must update to Version 2.2 to fix these flaws.