Cisco and Pulse Secure have both issued security advisories warning of critical Remote Code Execution vulnerabilities that affect some of their VPN servers.
Pulse Secure
Pulse Secure has shipped a patch to resolve several Remote Code Execution vulnerabilities in its Connect Secure VPN appliances. The August release addresses these issues and the vendor ‘strongly advises’ clients to apply the 9.1R12 release to protect their networks.
The critical vulnerability (CVE-2021-22937) is actually a means to bypass the fix to the headline grabbing CVE-2020-8260 remote code execution vulnerability (patched in October 2020) which was used in widespread cyber attacks.
Cisco
Cisco has released patches to address remote code execution vulnerabilities that affect several of their Small Business VPN routers – and warns of another RCE vulnerability that is not yet patched.
This critical (CVSS 9.8) patch resolves several vulnerabilities which could allow an attacker to: execute arbitrary code, cause a denial-of-service or execute arbitrary commands with root privilege on the affected device.
This impacts RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN routers that are running firmware earlier than 1.0.03.22
This vulnerability in the web management interface of several Cisco Small Business Routers could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of the device. This affects RV160, RV160W, RV260, RV260P, and RV260W VPN routers.
CVE-2021-1585 affects CISCO’s Firewall Management app which is vulnerable to a man-in-the-middle attack which can deliver code to the PC of the network admin using the software and then execute it in the context of the running app.
Network infrastructure devices – like firewalls, routers and VPN appliances – need to be patched with firmware updates to resolve security vulnerabilities just like desktop PC and servers. However, because they are hidden in data centres and networking cabinets it is easy to overlook them and leave them vulnerable. It is important to ensure network devices are included in regular patching.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)