Cisco’s Bug Bonanza: New Patches Fix Critical Flaws, But Will They Hold?
Cisco patches bugs in its products, addressing vulnerabilities that could allow threat actors to log in or take over devices. The flaws include an OS command injection in Cisco Identity Service Engine (CVE-2024-20469) and a backdoor account in Smart Licensing Utility (CVE-2024-20439). Admins are urged to update affected versions.
Hot Take:
Looks like Cisco’s been busy plugging holes, but hey, who knew software licensing could be such a juicy target? Just your friendly neighborhood hackers turning “Smart Licensing” into a “Smart Exploiting” party. Yikes!
Key Points:
- Cisco released patches for multiple vulnerabilities in their products.
- CVE-2024-20469: OS command injection vulnerability in Cisco’s Identity Service Engine (ISE) with a severity score of 6.0.
- CVE-2024-20439: Undocumented static user credential in Smart Licensing Utility (SLU) software with a severity score of 9.8.
- CVE-2024-20440: Excessive verbosity in debug log file in SLU, also with a severity score of 9.8.
- Admins should upgrade ISE to versions 3.2P7 or 3.3P4 and SLU to version 2.3.0 to secure their systems.
Already a member? Log in here