情報源
CISA Current Activity
Cisco Releases Security Updates for Security Manager
https://us-cert.cisa.gov/ncas/current-activity/2020/11/17/cisco-releases-security-updates-security-manager
Cisco Releases Security Updates for Multiple Products
https://us-cert.cisa.gov/ncas/current-activity/2020/11/19/cisco-releases-security-updates-multiple-products
概要
– Cisco Security Manager
– 5000 Series Enterprise Network Compute System (ENCS) Platforms
– UCS C-Series Rack Servers in standalone mode
– UCS E-Series Servers
– UCS S-Series Servers in standalone mode
– Cisco DNA Spaces Connector software
– Cisco IoT Field Network Director (FND)
– Cisco AsyncOS for the Secure Web Appliance
関連文書 (日本語)
JPCERT/CC 注意喚起
Cisco Security Manager の複数の脆弱性に関する注意喚起
https://www.jpcert.or.jp/at/2020/at200043.html
関連文書(英語)
Cisco Security Manager Path Traversal Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-path-trav-NgeRnqgR
Cisco Security Manager Static Credential Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-rce-8gjUz9fW
Cisco Security Manager Java Deserialization Vulnerabilities
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-java-rce-mWJEedcD
Cisco Integrated Management Controller Multiple Remote Code Execution Vulnerabilities
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-api-rce-UXwpeDHd
Cisco DNA Spaces Connector Command Injection Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dna-cmd-injection-rrAYzOwc
Cisco IoT Field Network Director Unauthenticated REST API Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-BCK-GHkPNZ5F
Cisco Secure Web Appliance Privilege Escalation Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-nPzWZrQj
Cisco IoT Field Network Director SOAP API Authorization Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-AUTH-vEypBmmR
Cisco IoT Field Network Director Missing API Authentication Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-APIA-xZntFS2V
引用元:JPCERTコーディネーションセンター
「JPCERT/CC WEEKLY REPORT 2020-11-26」
https://www.jpcert.or.jp/wr/2020/wr204601.html