A recently discovered flaw in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager allows threat actors to waltz past security protections and log into endpoints with non-default configurations, the company has confirmed.
An advisory published by Cisco revealed the company stumbled upon the flaw while addressing a support case via Cisco TAC. While it claims there is no evidence of the flaw being exploited in the wild, it is now being tracked as CVE-2022-20798.
The good news is that a patch is already available, and users are urged to apply it immediately.
Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022 (opens in new tab). Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey (opens in new tab) to get the bookazine, worth $10.99/£10.99.
It revolves around authentication checks on endpoints using Lightweight Directory Access Protocol (LDAP) for external authentication, the company said. Allegedly, it only affects appliances configured to use external authentication, and LDAP. These things are turned off by default, though.
"An attacker could exploit this vulnerability by entering a specific input on the login page of the affected device," Cisco says. "A successful exploit could allow the attacker to gain unauthorized access (opens in new tab) to the web-based management interface of the affected device."
> Cisco warns of new bug that could let hackers run off with admin credentials (opens in new tab)
> Cisco will not patch serious security hole in its old VPN routers (opens in new tab)
> Cisco tells firewall users to update now or potentially miss vital security updates (opens in new tab)
Users can check if their appliance has external authentication enabled by logging into the web-based management interface, navigating to System Administration > Users, and looking for “Enable External Authentication”.
Even though installing the patch is the best way to mitigate the threat, there are other workarounds, including disabling anonymous binds on the external authentication server.
This is not the first time Cisco has had to patch Secure Email gateway. Earlier this year, it fixed a flaw that allowed remote attackers to break unpatched appliances with the help of malicious emails (opens in new tab).
Cisco also said it will not be fixing a zero-day found in RV110W, RV130, RV130W, and RV215W SMB routers, as these devices have reached end-of-life, BleepingComputer found. Businesses using these endpoints (opens in new tab) could be at risk, given that the zero-day allows attackers to execute arbitrary code with root-level privileges.
Via: BleepingComputer (opens in new tab)