Cisco Releases Security Updates for Multiple Products
Security updates address one Critical, three High and three Medium severity vulnerabilities in Expressway Series, Cisco TelePresence Video Communication Server, and other products
Summary
Security updates address one Critical, three High and three Medium severity vulnerabilities in Expressway Series, Cisco TelePresence Video Communication Server, and other products
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Cisco has released security updates to address one Critical, three High and three Medium severity vulnerabilities in Expressway Series, Cisco TelePresence Video Communication Server, and other products.
The Critical severity advisory covers both CVE-2023-20105 and CVE-2023-20192, which could allow an authenticated attacker with Administrator-level read-only credentials to escalate privileges to Administrator with read-write credentials on an affected system.
A High severity vulnerability in the client update feature of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could also allow a low-privileged, authenticated, local attacker to escalate privileges.
Remediation advice
Affected organisations are encouraged to review the following Cisco Security Advisories for more information.
Remediation steps
| Type | Step |
|---|---|
| Patch |
Cisco Expressway Series and Cisco TelePresence Video Communication Server Privilege Escalation Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-priv-esc-Ls2B9t7b |
| Patch |
Cisco Unified Communications Manager IM & Presence Service Denial of Service Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-imp-dos-49GL7rzT |
| Patch |
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 2100 Series Appliances SSL/TLS Denial of Service Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ssl-dos-uu7mV5p6 |
| Patch |
Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows Privilege Escalation Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-csc-privesc-wx4U4Kw |
| Guidance |
Cisco Small Business 200, 300, and 500 Series Switches Web-Based Management Stored Cross-Site Scripting Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-sxss-OPYJZUmE |
| Patch |
Cisco Unified Communications Manager Denial of Service Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-dos-4Ag3yWbD |
| Patch |
Cisco Secure Workload Authenticated OpenAPI Privilege Escalation Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-auth-openapi-kTndjdNX |
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 8 June 2023 3:29 pm