Cisco Released Security Updates – 25 August 2022

The released updates to fix multiple vulnerabilities affecting Cisco FXOS Software, Cisco NX-OS Software and Cisco ACI Multi-Site Orchestrator (MSO). The addressed vulnerabilities could allow the attackers to perform several attacks such as denial of service, privilege escalation and remote code execution.

Samples of the addressed vulnerabilities:

1. Cisco ACI Multi-Site Orchestrator (MSO) Privilege Escalation Vulnerability
   (CVE-2022-20921):
   The remote attacker could elevate to Administrator privileges by sending specially crafted HTTP requests to the affected device, due to improper authorization on specific APIs.
   • CVSS: 8.8
   • Attack Vector: Network
   • Attack Complexity: Low
   • Privileges Required: Low
   • User Interaction: None
   • Consequences: Gain Privileges
     
     
2. Cisco FXOS and NX-OS Software Cisco Discovery Protocol Denial of Service and Arbitrary Code Execution Vulnerability (CVE-2022-20824):
   The addressed vulnerability could allow the unauthenticated, adjacent attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) by sending a malicious Cisco Discovery Protocol packet to the affected device.

1. 1. CVSS: 8.8
   2. Attack Vector: Adjacent Network
   3. Attack Complexity: Low
   4. Privileges Required: None
   5. User Interaction: None
   6. Consequences: Gain Access