Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch
Brief
Cisco is looking to get ahead of attackers with a new set of more than a half-dozen fixes, some of them critical, for its IOS XR Linux-based network operating system (OS).
As part of its regular testing, Cisco’s software engineering team flagged “multiple internally-discovered vulnerabilities ,” the company said. These flaws could allow attackers to perform remote code execution (RCE) and gain root access on a router, thereby allowing them to intercept traffic. Other potential risks could include access control failures, buffer overflows, and out-of-bounds access.
Cisco said all IOS XR releases, including IOS XR7, are impacted, regardless of configuration. There are no known workarounds, but the company has released software updates.
Cisco emphasizes that, as of yet, the vulnerabilities are not known to be actively exploited.