Cisco Data Center software includes remote access flaw

Cisco has released a patch to a recently-discovered security flaw in the Data Center Network Manager software.
The Data Center Network Manager (DCNM) software is used to manage switches and routers connected through LAN and SAN environments, including the Cisco Nexus switches and MDS enterprise SAN switches.
The vulnerability affects DCNM versions 11.0 or later, exposing sensitive data through a potential directory traversal attack.
The vulnerability is located in the management interface, where user requests may be improperly validated.
Exploiting this vulnerability, hackers could gain remote access to sensitive files by sending malicious requests containing instructions allowing access to the parent directory.
Once in the parent directory, a hacker can access sensitive information stored on the network, or create their own files and insert them into the system.
However, to take this action a hacker would need valid credentials, and to the company’s knowledge, the vulnerability has not yet been exploited in the real world.
A software update has been created to address this issue, however, there is no workaround available for users.
The patch is available only to DCNM customers with a valid software license.
The patch checks the version number through the web interface to see if the vulnerability exists, however, the web interface is not available in older versions of the software.
Researchers at Tenable, who first discovered the error, noted that the path traversal vulnerability is in the Download servlet and that a remote attacker could use this vulnerability to both access files and create directories.
In June of this year, Cisco received a number of questions about its practice of waiting weeks, or even months, before notifying customers of known security issues.
Cisco’s response noted that the delay was built into the notification system, as publicizing a critical vulnerability prior to having a patch for all affected versions would open other customers up to potential exploitation.
Source: thestack

Latest Jobs
-
- CIAM Architect Azure B2C
- N/A
- N/A
-
We are seeking a highly skilled and experienced Azure B2C CIAM Architect for a contract starting on Jan 2024. As an Azure B2C CIAM Architect, you will be responsible for designing, implementing, and deploying an new Azure B2C Solution . Responsibilities: Design and implement an Azure B2C-based CIAM solution that meets the needs of our clients organization. Maintain and support the Azure B2C-based CIAM solution. Provide training and support to our employees on the use of the CIAM solution. Background designing, implementing, and maintaining CIAM solutions. Experience with cloud-based identity and access management (IAM) solutions. Experience with OAuth, OpenID Connect,and SAML. Excellent written and verbal communication skills
-
- Senior IAM Consultant
- Germany
- Upto €110,000 depending on level of position
-
Senior IAM Consultant is needed to help lead and deploy IAM Projects for this expand IAM Consultancy The ideal candidate will have a deep understanding of IAM concepts and technologies, as well as experience in deploying and managing complex IAM solutions. Responsibilities Lead the deployment of IAM solutions for our clients Work with clients to understand their IAM requirements and design solutions that meet their needs Configure and implement IAM solutions using best practices Integrate IAM solutions with other enterprise systems Provide training and support to clients on the use of IAM solutions Stay up-to-date on the latest IAM technologies and trends We are looking for an experieneced IAM Consutlatn with: Strong understanding of IAM concepts and technologies,including identity lifecycle management,access control,and authentication Experience in deploying and managing complex IAM solutions Experience with IAM products and solutions,such as SailPoint,One Identity Manager,and Azure Active Directory Excellent communication and interpersonal skills Ability to work independently and as part of a team Fluent in German Candidates witll need to live and have the right to work within Germany to be considered.
-
- Security Architect - SOC Design - Outside IR35 London. SC / DV cleared
- London
- Outside IR35
-
Security Architect - With in-depth SOC Design experience needed for Outside IR35 London. SC / DV cleared. 6 month rolling Immediate Experience delivering technical Security Architecture design / assurance of security design with mobile network experience. HLD / LLD Current SC Clearance a must. Willingness to undertake DV. London 3 days a week Immediately interviewing.
-
- Cyber Security Risk Consultant. UK. Hybrid. Home | Work balance
- United Kingdom
- N/A
-
Cyber Security Consultancy - done the right way. Seeking a passionate Cyber Security Risk Consultant who enjoys helping clients make a different to their business. Warning- if you want a large, slow moving, high politics, high travel security consultancy that demands their a pound of flesh this is NOT for you. A successful individual will have experience working with clients to identify business cyber security risk. This is a remote first opportunity which means you will spend the majority of your time working remotely. You will however spend some time meeting clients as well as meeting up with the team on a monthly basis.. Some of the nice to have certifications. CRISC, ISO27001 Lead implementer, CISA, CISM, CISSP Along with dedicated training budgets, unlimited holiday and a structured career path, this opportunity will give a much needed work life balance. Unable to offer Visa sponsorship now or in the future. Apply and book a call in my diary with the below