Cisco’s October 21 advisory bundle is out, and the big one is a remote code execution bug in Cisco Expressway (Expressway-C and Expressway-E).
What to know
- An unauthenticated attacker with network access to the device can run operating system commands as root.
- It comes from persistent cookies in the database service, plus client certificates that aren’t validated when TLS Verify Mode is on for clustering.
- An attacker with the cookies can connect to the database service and call specific RPC commands.
- Fixed software is out, and there are no workarounds.
- The same bundle also covers Snort 3, ASR 9000 and Secure Client, so check Cisco’s full list.
My take
Root, no login and no workaround means patch it today. If you run Expressway, keep the database and cluster ports off networks that don’t need them.
Have a blessed day! And Happy Hacking!
