SB2021110417 - Multiple vulnerabilities in Cisco Catalyst PON Series Switches
Published: November 4, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Use of hard-coded credentials (CVE-ID: CVE-2021-34795)
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to an unintentional debugging credential that exists on the device. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2021-40112)
The vulnerability allows a remote attacker to modify the configuration of the device.
The vulnerability exists due to improper HTTPS input validation. A remote attacker can send a specially crafted HTTPS request to the web management interface and modify the configuration.
3) Command Injection (CVE-ID: CVE-2021-40113)
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the web-based management interface. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.