保安警报 (A24-10-04): Cisco 产品多个漏洞

描述:

Cisco 发布了安全公告，以应对 Cisco 装置及软件的多个漏洞。有关漏洞及攻击向量的资料，请参阅供应商网站的相应安全公告。

受影响的系统:

• Cisco Expressway Series
• Cisco Identity Services Engine
• Cisco Meraki MX and Z Series Teleworker Gateway with AnyConnect VPN enabled
• Cisco Nexus Dashboard
• Cisco Nexus Dashboard Fabric Controller
• Cisco Nexus Dashboard Insights
• Cisco Nexus Dashboard Orchestrator
• Cisco Small Business RV042、 RV042G、 RV320、 RV325、 RV340、 RV340W、 RV345 and RV345P Routers
• Cisco UCS B-Series、 Managed C-Series and X-Series Servers

有关受影响系统的详细资料，请参阅供应商网站的相应安全公告中有关 “Affected Products” 的部分。

影响:

成功利用漏洞可以在受影响的系统导致远端执行程式码、 服务被拒绝、 泄漏资讯、 权限提升或绕过保安限制，视乎攻击者利用哪些漏洞而定。

建议:

适用于受影响系统的修补程式已可获取。受影响系统的系统管理员应遵从供应商的建议，立即採取行动以降低风险。有关修补程式的详细资料，请参阅供应商网站的相应安全公告中有关 “Fixed Software”的部分。

系统管理员可联络其供应商，以取得修补程式及有关支援。

进一步资讯:

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-redfish-cominj-sbkv5ZZ
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expw-escalation-3bkz77bD
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disc-ZYF2nEEX
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-by-QWUkqV7X
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-QTRHzG2
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-cidv-XvyX2wLj
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-cmdinj-UvYZrKfr
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-ptrce-BUSHLbp
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-idv-Bk8VqEDc
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndo-tlsvld-FdUF3cpw
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv34x-privesc-rce-qE33TCms
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv04x_rv32x_vulns-yJ2OSDhV
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20365
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20385
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20393
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20432
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20438
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20441 (to CVE-2024-20442)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20444
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20448 (to CVE-2024-20449)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20470
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20477
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20490 (to CVE-2024-20492)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20498 (to CVE-2024-20502)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20509
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20513
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20515 (to CVE-2024-20524)