Issue 149: Vulnerabilities on Cisco routers and Bumble, adopting Zero Trust for APIs, a hacker’s view on API security challenges
Brief
This week, we have vulnerabilities on Cisco routers allowing device takeover, a vulnerability on the Bumble app disclosing user’s location, a view on adopting Zero Trust for APIs, and a hacker’s view on API security challenges.
Vulnerability: Cisco releases critical patches
Cisco Systems has released a total of six security patches for API vulnerabilities this week. The patches were related to their high-end networking equipment, as detailed in this article from Threatpost. The most serious of these was rated as critical with a severity of 9. 1 and allowed possible overwrite of the target filesystem. The vulnerability is detailed in NIST CVE-2021-1577 as well as by Cisco themselves.
Cisco provides no details of the vulnerability, or how it was discovered.