保安警報 (A24-10-04): Cisco 產品多個漏洞

描述:

Cisco 發布了安全公告，以應對 Cisco 裝置及軟件的多個漏洞。有關漏洞及攻擊向量的資料，請參閱供應商網站的相應安全公告。

受影響的系統:

• Cisco Expressway Series
• Cisco Identity Services Engine
• Cisco Meraki MX and Z Series Teleworker Gateway with AnyConnect VPN enabled
• Cisco Nexus Dashboard
• Cisco Nexus Dashboard Fabric Controller
• Cisco Nexus Dashboard Insights
• Cisco Nexus Dashboard Orchestrator
• Cisco Small Business RV042、 RV042G、 RV320、 RV325、 RV340、 RV340W、 RV345 and RV345P Routers
• Cisco UCS B-Series、 Managed C-Series and X-Series Servers

有關受影響系統的詳細資料，請參閱供應商網站的相應安全公告中有關 “Affected Products” 的部分。

影響:

成功利用漏洞可以在受影響的系統導致遠端執行程式碼、 服務被拒絕、 泄漏資訊、 權限提升或繞過保安限制，視乎攻擊者利用哪些漏洞而定。

建議:

適用於受影響系統的修補程式已可獲取。受影響系統的系統管理員應遵從供應商的建議，立即採取行動以降低風險。有關修補程式的詳細資料，請參閱供應商網站的相應安全公告中有關 “Fixed Software”的部分。

系統管理員可聯絡其供應商，以取得修補程式及有關支援。

進一步資訊:

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-redfish-cominj-sbkv5ZZ
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expw-escalation-3bkz77bD
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disc-ZYF2nEEX
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-by-QWUkqV7X
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-QTRHzG2
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-cidv-XvyX2wLj
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-cmdinj-UvYZrKfr
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-ptrce-BUSHLbp
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-idv-Bk8VqEDc
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndo-tlsvld-FdUF3cpw
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv34x-privesc-rce-qE33TCms
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv04x_rv32x_vulns-yJ2OSDhV
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20365
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20385
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20393
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20432
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20438
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20441 (to CVE-2024-20442)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20444
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20448 (to CVE-2024-20449)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20470
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20477
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20490 (to CVE-2024-20492)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20498 (to CVE-2024-20502)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20509
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20513
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20515 (to CVE-2024-20524)