Cisco Security Updates – 11 January 2024

By /
  • 11/2024
  • High

Cisco has released security updates to fix several vulnerabilities in multiple Cisco products.

The addressed vulnerabilities could allow the attacker to upload arbitrary files, gain elevated privileges to root, trigger cross-site scripting attacks, manipulate data by sending specially crafted SQL statements, or execute arbitrary commands and gain access to the affected products.

Sample of the addressed vulnerabilities:

1. Cisco Unity Connection File Upload Vulnerability (CVE-2024-20272):

  • CVSS: 7.3
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Gain Access

2. Cisco ThousandEyes Enterprise Agent Virtual Appliance Privilege Escalation (CVE-2024-20277):

  • CVSS: 6.8
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: Required
  • Consequences: Gain Privileges
Vulnerabilities

Cisco Security Updates

Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Cisco Security Updates

References

Cisco Security Updates