Cisco fixes critical flaw in network management platform

The latest security hole is patched just days before the firm’s flagship Cisco Live 2020 conference

Cisco has urged its customers to update their Firepower Management Center (FMC) after patching a critical vulnerability that could have given attackers administrative privileges on affected devices.

Dubbed CVE-2019-16028, the vulnerability has been found in the firm’s platform for managing its network security products, including firewalls or malware protection. It has been given a CVE rating of 9.8, meaning it has been branded as ‘critical’

Related Resource

How targeted simulations differ from penetration tests and vulnerability scanning

Stay one step ahead of cyber attackers

Download now

“The vulnerability is due to improper handling of Lightweight Directory Access Protocol (LDAP) authentication responses from an external authentication server,” an advisory from the company said

Advertisement - Article continues below

“An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to gain administrative access to the web-based management interface of the affected device.

“The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.”

The flaw affects numerous versions of FMC, including several that have reached end-of-life, namely 6.1.0, 6.2.0, 6.2.1, and 6.2.2. Cisco has advised businesses using these iterations to upgrade to a release that integrates the fix before patching, such as versions 6.2.3, 6.3.0, 6.4.0, or 6.5.0. 

The networking giant’s latest security issue has arisen just days before the firm is set to host its flagship Cisco Live 2020 conference in Barcelona.

The company has endured a topsy-turvy 2019, with a spate of security issues and negative headlines affecting its fortunes. For example, in August last year, three major vulnerabilities were found in the most popular switches used by its small and medium-sized business (SMB) customers. 

Advertisement
Advertisement - Article continues below

This is in addition to its WebEx and Zoom platforms being hit with the ‘prying eye’ flaw in October, that would allow an attacker to use an enumeration attack to find open calls or meetings, if successfully exploited.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now
Advertisement

Most Popular

Visit/operating-systems/microsoft-windows/355812/microsoft-warns-against-installing-windows-10-may-2020
Microsoft Windows

Microsoft warns users not to install Windows 10's May update

28 May 2020
Visit/security/data-breaches/355777/easyjet-faces-class-action-lawsuit-over-data-breach
data breaches

EasyJet faces class-action lawsuit over data breach

26 May 2020
Visit/security/cyber-security/355797/microsoft-bans-trend-micros-rootkit-buster-from-windows-10
cyber security

Microsoft bans Trend Micro driver from Windows 10 for "cheating" hardware tests

27 May 2020