Cisco and Pulse Secure have both issued security advisories warning of critical Remote Code Execution vulnerabilities that affect some of their VPN servers.

Pulse Secure

Pulse Secure has shipped a patch to resolve several Remote Code Execution vulnerabilities in its Connect Secure VPN appliances.  The August release addresses these issues and the vendor ‘strongly advises’ clients to apply the 9.1R12 release to protect their networks.

The critical vulnerability (CVE-2021-22937) is actually a means to bypass the fix to the headline grabbing CVE-2020-8260 remote code execution vulnerability (patched in October 2020) which was used in widespread cyber attacks.

Cisco

Cisco has released patches to address remote code execution vulnerabilities that affect several of their Small Business VPN routers – and warns of another RCE vulnerability that is not yet patched.

CVE-2021-1609

This critical (CVSS 9.8) patch resolves several vulnerabilities which could allow an attacker to: execute arbitrary code, cause a denial-of-service or execute arbitrary commands with root privilege on the affected device.

This impacts RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN routers that are running firmware earlier than 1.0.03.22

CVE-2021-1602

This vulnerability in the web management interface of several Cisco Small Business Routers could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of the device.  This affects RV160, RV160W, RV260, RV260P, and RV260W VPN routers.

CVE-2021-1585 affects CISCO’s Firewall Management app which is vulnerable to a man-in-the-middle attack which can deliver code to the PC of the network admin using the software and then execute it in the context of the running app.

Network infrastructure devices – like firewalls, routers and VPN appliances – need to be patched with firmware updates to resolve security vulnerabilities just like desktop PC and servers.  However, because they are hidden in data centres and networking cabinets it is easy to overlook them and leave them vulnerable.  It is important to ensure network devices are included in regular patching.