Cisco Patches a Dozen Critical Vulnerabilities

Cisco announced security updates fixing 35 vulnerabilities, including more than a dozen critical-severity flaws affecting various products such as Meraki, License On-Prem, NX-OS, APIC, and Finesse. The critical vulnerabilities include memory corruption issues (e.g., buffer overflows, out-of-bounds writes), improper access control, missing authentication, improper cryptographic signature verification, insufficient credential protection, OS injection, and SSRF. Some vulnerabilities allow remote unauthenticated attackers to execute arbitrary code with root privileges or cause DoS conditions. Cisco has released patches for all these issues and is not aware of any active exploitation.

The vulnerabilities could lead to unauthorized access, information disclosure, privilege escalation, denial of service, and remote code execution on affected Cisco products. Exploitation could allow attackers to gain elevated privileges or disrupt network operations. However, Cisco has stated there are no known active exploits in the wild at this time.

Cisco has released official patches for all identified vulnerabilities across affected products. Users and administrators should apply these updates promptly as per Cisco's security advisories. Since the vulnerabilities are patched, no additional urgent mitigation steps are required beyond applying the official fixes.